JR52775: SECURITY APAR CVE-2014-8917 - DOJO LIBRARY IN IBM BPM FILENET DOCSTORE ADMIN VULNERABLE TO CROSS-SITE SCRIPTING ATTACKS

8.5.5.0-WS-BPM-IFJR52775
8.5.6.0-WS-BPM-IFJR52775
bpm.8560.cf1.delta.repository.1
bpm.8560.cf1.delta.repository.2
Version 8.5 Refresh Pack 7 for the IBM Business Process Manager products

APAR status

• Closed as program error.

Error description

• The Dojo toolkit that is shipped with IBM Business Process
  Manager (BPM) in the DocStore Admin application is vulnerable to
  cross-site scripting (XSS) because user-supplied input is
  improperly validated. If your coaches use the Dojo toolkit, a
  remote attacker could exploit this vulnerability by using a
  specially crafted URL to, when the URL is clicked, run a script
  in the user's web browser within the security context of the
  hosting website. An attacker could use this vulnerability to
  steal the user's cookie-based authentication credentials.
  

Local fix

Problem summary

• No additional information is available.
  

Problem conclusion

• A fix is available for IBM BPM 8.5.5 and 8.5.6 that removes
  files from Dojo that can cause cross-site scripting
  vulnerability.
  
  On Fix Central (http://www.ibm.com/support/fixcentral), search
  for JR52775:
  
  1. Select IBM Business Process Manager with your edition from
    the product selector, the installed version to the fix pack
    level, and your platform, and then click Continue.
  
  2. Select APAR or SPR, enter JR52775, and click Continue.
  
  When you download fix packages, ensure that you also download
  the readme file for each fix. Review each readme file for
  additional installation instructions and information about the
  fix.
  

Temporary fix

• Not applicable
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BPM STANDARD

• Fixed component ID

  5725C9500

Applicable component levels