CVE-2024-28781

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
5.4MEDIUM
EPSS
0.3%
top 48.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Devops DeployIBM Urbancode Deploy
Timeline
PublishedMay 14

Description

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4, and 8.0 through 8.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 285654.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶NVDibm/urbancode_deploy7.0.0.0 — 7.0.5.21+3
▶CVEListV5ibm/urbancode_deploy7.0 — 7.0.5.20+4
▶NVDibm/devops_deploy8.0.0.0 — 8.0.1.0

🔴Vulnerability Details

2
GHSA
GHSA-vgjq-3m42-w385: IBM UrbanCode Deploy (UCD) 7↗2024-05-14
▶
CVEList
IBM UrbanCode Deploy cross-site scripting↗2024-05-10
▶
CVE-2024-28781 (MEDIUM CVSS 5.4) | IBM UrbanCode Deploy (UCD) 7.0 thro | cvebase.io