CVE-2024-41785 — Cross-site Scripting in IBM Concert Software

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.3%
top 45.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Concert SoftwareIBM Concert
Timeline
PublishedNov 15

Description

IBM Concert Software 1.0.0 through 1.0.1 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5ibm/concert_software1.0.0, 1.0.1
▶NVDibm/concert1.0.0, 1.0.1+1

🔴Vulnerability Details

2
CVEList
IBM Concert cross-site scripting↗2024-11-15
▶
GHSA
GHSA-3qf8-q2rg-6p4p: IBM Concert Software 1↗2024-11-15
▶
CVE-2024-41785 — Cross-site Scripting in IBM | cvebase