Cross-Site Scripting Vulnerability in IBM Sterling Partner Engagement Manager
CVE-2022-22417

5.4MEDIUM

Key Information:

Vendor
IBM
Status
Sterling Partner Engagement Manager On Cloud
Sterling Partner Engagement Manager
Vendor
CVE Published:
19 July 2022

Summary

IBM Sterling Partner Engagement Manager versions 6.1.2, 6.2, and Cloud/SaaS 22.2 are susceptible to a cross-site scripting vulnerability that enables attackers to inject arbitrary JavaScript code into the Web UI. This defect can compromise the integrity of user sessions, allowing an attacker to execute malicious scripts within the context of a trusted user, potentially leading to unauthorized access to sensitive information and credentials. Users are encouraged to evaluate their version for mitigation steps.

Affected Version(s)

Sterling Partner Engagement Manager 6.1.2

Sterling Partner Engagement Manager 6.2

Sterling Partner Engagement Manager on Cloud 22.2

References

https://www.ibm.com/support/pages/node/6604991
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/223127
vdb-entryx_refsource_XF

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.