It is not clear if this bug is fixed in 11.0(3)ES6. The tool kind of indicates that it is as it says that it is "fixed" and 11.0(3) is not one of the affected releases, but it is not in the release notes as being fixed in any of the versions of 11.0(3) including ES6 which came out about the same time the Bug ID was updated:
Issues resolved in this Engineering Special
-------------------------------------------
CDETS Summary
CSCvg37067: CIM 9.0 X-content-type-options vulnerability blank page
CSCvg80681: Cisco Service is unable to start on EIM Service Server
CSCvh07056: 11.0.3ES3 Pick activities dialog not resizing
CSCvh19388: Multiple Vulnerabilities in commons-fileupload
CSCvh43848: HTTP 500 error when creating new user or selecting an existing user with System Administration role
CSCvh66246: Unable to send email activities EIMWIM 11.0(3) ES5, when there are duplicate inline images in an email
CSCvh12714: Unable to edit Archive job schedule Start time and End Time on
CSCvh71986: Activity gets routed to the default exception queue
CSCvg24666 CSCvg74365: "Send email to the agent when new activity is assigned" setting is not working
CSCvh97687: Strict-Transport-Security header is missing
