Cross-Site Scripting Vulnerability in IBM Cloud Pak for Security
CVE-2022-36776

5.4MEDIUM

Key Information:

Vendor

IBM
Status
Cloud Pak For Security
Vendor
CVE Published:
11 November 2022

What is CVE-2022-36776?

IBM Cloud Pak for Security versions 1.10.0.0 and 1.10.2.0 are susceptible to a cross-site scripting vulnerability. This issue enables users to inject arbitrary JavaScript code into the Web UI, which may compromise the integrity of the application and expose sensitive user information such as credentials during established sessions. Proper validation and sanitization measures are crucial to mitigate potential risks associated with this vulnerability.

Affected Version(s)

Cloud Pak for Security 1.10.0.0, 1.10.2.0

References

https://www.ibm.com/support/pages/node/6833574
vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/233663
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.