Cross-Site Scripting Vulnerability in IBM Security SiteProtector System
CVE-2020-4140

5.4MEDIUM

Key Information:

Vendor

IBM
Status
Security Siteprotector System
Vendor
CVE Published:
12 November 2021

What is CVE-2020-4140?

The IBM Security SiteProtector System version 3.1.1 contains a vulnerability that enables cross-site scripting attacks. This flaw permits an attacker to inject malicious JavaScript code into the Web UI, potentially compromising the integrity of user sessions. As a result, sensitive information, such as user credentials, may be exposed within a trusted environment, posing significant security risks to the affected users and the system.

Affected Version(s)

Security SiteProtector System 3.1.1

References

https://www.ibm.com/support/pages/node/6515054
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/174052
vdb-entryx_refsource_XF

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.