5.4

CVE-2025-36033

IBM Engineering Lifecycle Management - Global Configuration Management is vulnerable to cross-site scripting

IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 through 7.1.0 Interim Fix 004 IBM Global Configuration Management is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update -
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix002
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix003
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix004
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix005
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix006
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix007
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix008
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix009
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix010
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix011
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix012
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix013
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix014
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix015
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix016
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix017
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update -
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update ifix001
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update ifix0010
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update ifix002
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update ifix003
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update ifix004
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.14% 0.033
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
IBM 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.ibm.com/support/pages/node/7258063
Vendor Advisory