CVE-2025-1997

CWE-804 documents4 sources
Severity
4.6MEDIUM
EPSS
0.1%
top 70.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Devops DeployIBM Urbancode Deploy
Timeline
PublishedMar 27

Description

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 and 8.1 through 8.1 is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages4 packages

▶NVDibm/devops_deploy8.0.0.0 — 8.0.1.5+1
▶NVDibm/urbancode_deploy7.0.0.0 — 7.0.5.26+3
▶CVEListV5ibm/devops_deploy8.0 — 8.0.1.4+1
▶CVEListV5ibm/urbancode_deploy7.0 — 7.0.5.25+3

🔴Vulnerability Details

2
GHSA
GHSA-2pv7-j3wp-jhrp: IBM UrbanCode Deploy (UCD) 7↗2025-03-27
▶
CVEList
IBM UrbanCode Deploy (UCD) / IBM DevOps Deploy HTML injection↗2025-03-27
▶
CVE-2025-1997 (MEDIUM CVSS 4.6) | IBM UrbanCode Deploy (UCD) 7.0 thro | cvebase.io