Resolved -
We have created a hotfix for this issue. We advise all our Business Suite partners and customers to apply this hotfix at the earliest opportunity. The risk can further be mitigated by ensuring that Policy Manager’s Web Reporting interface is not accessible from the internet. This can be done with external firewall configurations.
Investigating -
We have identified that WithSecure Policy Manager (PM) includes a version of the Axios library within the web reporting component that is currently flagged as vulnerable.
Based on our assessment, the associated risk is low. As a precautionary measure, we recommend the following:
Reviewing the current firewall and network configuration to ensure that the Policy Manager webreporting interface is not accessible from external networks
Ensuring restricted access to this component significantly reduces any potential exposure.
We are investigating on a fix for the issue.
Apr 14, 14:35 UTC