CVE-2024-27270

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

6.1MEDIUM

EPSS

0.1%

top 74.98%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Websphere Application Server IBM Websphere Application Server Liberty

Timeline

PublishedMar 27

Description

IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in a specially crafted URI. IBM X-Force ID: 284576.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 1.6 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5ibm/websphere_application_server_liberty23.0.0.3 — 24.0.0.3

▶NVDibm/websphere_application_server23.0.0.3 — 24.0.0.4

🔴Vulnerability Details

CVEList

IBM WebSphere Application Server Liberty cross-site scripting↗2024-03-27

▶

GHSA

GHSA-r637-wjq9-3jfr: IBM WebSphere Application Server Liberty 23↗2024-03-27

▶