PM76354: Security Issue in UI component

APAR status

• Closed as program error.

Error description

• Currently we provide whitelist support where we filter malicious
  urls, if you are using layerLoader.jsp to load custom modules,
  you'll need to apply this apar and specify a new REP name/value
  in WPConfigService as described in the readme for the apars.
  
  ref cmvc defect 302908
  

Local fix

• None available
  

Problem summary

• Currently we provide whitelist support where we filter
  malicious
  urls, if you are using layerLoader.jsp to load custom modules,
  you'll need to apply this apar and specify a new REP name/value
  in WPConfigService as described in the readme for the apars.
  
  ref cmvc defect 302908
  

Problem conclusion

• A code fix for this issue is integrated into the 8.0.0.0
  Combined Cumulative Fix 003 (PM74094) which is available from
  Fix Central:
  
  http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent
  =ibm~WebSphere&product=ibm/WebSphere/WebSphere+Portal&release=8
  .0.0.0&platform=All&function=aparId&apars=PM74094
  
  You might need to type or paste the complete address into your
  Web browser.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE PORTA

• Fixed component ID

  5724E7600

Applicable component levels

• R800 PSY

     UP