PJ37426: TO ADDRESS SECURITY VULNERABILITIES FOUND BY REGIONS

APAR status

• Closed as program error.

Error description

• When the customer ran the web vulnerability scanner against
  Recordsmanager, they found some security vulnerabilities in
  RecordsManager, like: Cross-Site Scripting, Cleartext submission
  of password, Session token in URL, Open redirection, etc.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * RM 4.5.1                                                     *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * When you run web vulnerability scanner against RM 4.5.1, the *
  * scanner will report some vulnerabilities: Cross-Site         *
  * Scripting, Open redirection, etc.                            *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Upgrade to RM 4.5.1.1-IER-FP001 and use SSL                  *
  ****************************************************************
  

Problem conclusion

• RM 4.5.1 patch 1 includes the fix for the known vulnerabilities
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  RECORDS MANAGER

• Fixed component ID

  5724S1900

Applicable component levels

• R451 PSY

     UP