IBM Infosphere BigInsights Multiple Security Vulnerabilities

Bugtraq ID:	101588
Class:	Unknown
CVE:	CVE-2017-1552 CVE-2017-1553 CVE-2017-1554
Remote:	Yes
Local:	No
Published:	Oct 25 2017 12:00AM
Updated:	Dec 19 2017 08:00PM
Credit:	IBM.
Vulnerable:	IBM InfoSphere BigInsights 4.2.5 IBM InfoSphere BigInsights 4.2
Not Vulnerable:

IBM Infosphere BigInsights Multiple Security Vulnerabilities

IBM Infosphere BigInsights is prone to the following multiple security vulnerabilities:

1. A link-injection vulnerability
2. A cross-site scripting vulnerability
3. A security-bypass vulnerability

An attacker may leverage these issues to inject arbitrary links to different pages within the application, or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, or to hijack the clicking action of the victim.

IBM Infosphere BigInsights versions 4.2 and 4.2.5 are vulnerable.

IBM Infosphere BigInsights Multiple Security Vulnerabilities

An attacker can use a web browser to exploit these issues.

IBM Infosphere BigInsights Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Infosphere BigInsights Multiple Security Vulnerabilities

References:

• IBM Homepage (IBM)
  
• swg22009192:BigInsights is affected by multiple vulnerabilities in BigSheets and (IBM)