IV82435: CROSS SITE SCRIPTING ISSUES

3.4.2-TIV-TAP-FP003-WIN
3.4.2-TIV-TAP-FP003-README
3.4.2-TIV-TAP-FP003-LIN
3.4.2-TIV-TAP-FP003-AIX
3.5.0-TIV-TAP-FP001-WIN
3.5.0-TIV-TAP-FP001-README
3.5.0-TIV-TAP-FP001-LIN
3.5.0-TIV-TAP-FP001-AIX

APAR status

• Closed as fixed if next.

Error description

• A Cross Site Scripting (XSS) attack occurs when an attacker
  uses a web
  application to inject malicious code in the form of a client
  side
  script   arbitrary JavaScript   to an end user.
  
  ONE EXAMPLE OF MANY THROUGHOUT THE APPLICAITON:
  
  Attack value: <img src='x' onerror='alert("7")'>
  
  Reproduction steps:
  1. Login into application
  2. Navigate to "My Reports" tab
  3. Click on "New" button
  4. Apply the attack value in "Header (Title)" textbox
  5. Fill other required details and click on "Save" button
  6. Click on "Run Report" button
  
  Again, this specific case is only with "My Reports" - we've
  replicated
  this issue in many locations throughout the entire site.
  

Local fix

• no
  

Problem summary

• A cross-site scripting security vulnerability was resolved in
  report manager. This is targeted to the 1H2016 release
  

Problem conclusion

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• 999
  

Fix information

Applicable component levels