CVE-2022-41299 - IBM Cloud Transformation Advisor cross-site scripting

Back Back to CVE browser

MEDIUM

IBM Cloud Transformation Advisor cross-site scripting

Published Dec 9, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.35%

Description

IBM Cloud Transformation Advisor 2.0.1 through 3.3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 237214.

Affected products

Vendor IBM Product Cloud Transformation Advisor Default
unaffected
- Version
  2.0.1
  Status
  affected
  Constraints
  <=3.3.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Cloud Transformation Advisor

unaffected

Version	Status	Constraints
2.0.1	affected	<=3.3.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://exchange.xforce.ibmcloud.com/vulnerabilities/237214
vdb-entryVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6846257
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://exchange.xforce.ibmcloud.com/vulnerabilities/237214		vdb-entryVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6846257		vendor-advisoryVendor Advisory