HTML Injection Vulnerability in IBM OpenPages by IBM

CVE-2024-49337

Summary

IBM OpenPages versions 8.3 and 9.0 are susceptible to an HTML injection vulnerability due to inadequate validation of user inputs in text fields employed to compose workflow email notifications. This flaw can be leveraged by remote authenticated attackers who include HTML tags in text fields of certain objects. As a result, malicious scripts can be injected into emails, which are executed in the context of the OpenPages mail client. This exploit potentially paves the way for phishing schemes and identity theft, posing significant security risks to users.

References