Stored Cross-Site Scripting Vulnerability in IBM Jazz for Service Management and Tivoli Netcool/OMNIbus_GUI
CVE-2021-29812

6.4MEDIUM

Key Information:

Vendor

IBM
Status
Jazz For Service Management
Vendor
CVE Published:
23 September 2021

What is CVE-2021-29812?

IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI are susceptible to a stored cross-site scripting vulnerability. This flaw enables attackers to inject arbitrary JavaScript code into the web user interface, compromising the application's intended functionality. As a result, there is a risk of disclosing sensitive credentials during trusted sessions. Organizations using these IBM products should take immediate action to mitigate potential exploits.

Affected Version(s)

Jazz for Service Management 1.1.3.10

References

https://www.ibm.com/support/pages/node/6491545
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/204330
vdb-entryx_refsource_XF

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.