CVE-2023-23481 - IBM Sterling Partner Engagement Manager cross-site scripting

Back Back to CVE browser

MEDIUM

IBM Sterling Partner Engagement Manager cross-site scripting

Published Jun 8, 2023

6.4

MEDIUM

CVSS 3.1

EPSS 0.37%

Description

IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 245889.

Affected products

Vendor IBM Product Sterling Partner Engagement Manager Default
unaffected
- Version
  6.1, 6.2, 6.2.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Sterling Partner Engagement Manager

unaffected

Version	Status	Constraints
6.1, 6.2, 6.2.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-27581
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/245889
vdb-entryVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/7001561
vendor-advisoryPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-27581		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/245889		vdb-entryVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/7001561		vendor-advisoryPatchVendor Advisory