CVE-2024-28772

Published: Jul 25, 2024Modified: Nov 21, 2024

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 285645.

Affected (3)

Products: Ibm: Security Directory Integrator, Security Directory Server, Security Verify Access

3 products

Security Directory Integrator

Security Directory Server

Security Verify Access

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Ibm Security Directory Integrator	Version 7.2.0
Ibm Security Directory Server	All versions
Ibm Security Verify Access	Version 10.0.0

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://exchange.xforce.ibmcloud.com/vulnerabilities/285645

Source: psirt@us.ibm.com

VDB Entry

https://www.ibm.com/support/pages/node/7161448

Source: psirt@us.ibm.com

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/285645

Source: af854a3a-2127-422b-91ae-364da2661108

VDB Entry

https://www.ibm.com/support/pages/node/7161448

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.