CVE-2024-28797 — Cross-site Scripting in IBM Infosphere Information Server

CWE-79 — Cross-site Scripting3 documents3 sources

Severity

5.4MEDIUMNVD

CNA6.4

EPSS

0.3%

top 49.35%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Infosphere Information Server

Timeline

PublishedJun 30

Description

IBM InfoSphere Information Server 11.7 is vulnerable stored to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 287136.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5ibm/infosphere_information_server11.7

▶NVDibm/infosphere_information_server11.7

🔴Vulnerability Details

CVEList

IBM InfoSphere Information Server cross-site scripting↗2024-06-30

▶

GHSA

GHSA-x7f5-fmr9-q92p: IBM InfoSphere Information Server 11↗2024-06-30

▶