CVE-2024-22359

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
6.1MEDIUM
EPSS
0.2%
top 61.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Devops DeployIBM Urbancode Deploy
Timeline
PublishedApr 12

Description

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 280897.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶NVDibm/urbancode_deploy7.0.0.0 — 7.0.5.21+3
▶CVEListV5ibm/urbancode_deploy7.0 — 7.0.5.20+3
▶NVDibm/devops_deploy8.0.0.0 — 8.0.1.0
▶CVEListV5ibm/devops_deploy8.0 — 8.0.0.1

🔴Vulnerability Details

2
GHSA
GHSA-3cpf-72w5-65j4: IBM UrbanCode Deploy (UCD) 7↗2024-04-12
▶
CVEList
IBM UrbanCode Deploy cross-site scripting↗2024-04-12
▶
CVE-2024-22359 (MEDIUM CVSS 6.1) | IBM UrbanCode Deploy (UCD) 7.0 thro | cvebase.io