Stored Cross-Site Scripting in IBM Jazz for Service Management
CVE-2021-38877

6.4MEDIUM

Key Information:

Vendor

IBM
Status
Jazz For Service Management
Vendor
CVE Published:
23 September 2021

What is CVE-2021-38877?

IBM Jazz for Service Management version 1.1.3.10 is susceptible to stored cross-site scripting, which allows for the injection of arbitrary JavaScript code into the application’s Web UI. This vulnerability poses a significant risk as it can alter the application's intended functionality, potentially leading to the exposure of confidential credentials during a trusted user session. Proper mitigation is essential to safeguard against any unauthorized access and ensure the integrity of user data.

Affected Version(s)

Jazz for Service Management 1.1.3.10

References

https://www.ibm.com/support/pages/node/6491521
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/208405
vdb-entryx_refsource_XF

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.