CVE-2023-42015 - IBM UrbanCode Deploy HTML injection

Back Back to CVE browser

MEDIUM

IBM UrbanCode Deploy HTML injection

Published Dec 19, 2023

4.3

MEDIUM

CVSS 3.1

EPSS 0.57%

Description

IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure. IBM X-Force ID: 265512.

Affected products

Vendor IBM Product UrbanCode Deploy Default
unaffected
- Version
  7.1
  Status
  affected
  Constraints
  <=7.1.2.14
- Version
  7.2
  Status
  affected
  Constraints
  <=7.2.3.7
- Version
  7.3
  Status
  affected
  Constraints
  <=7.3.2.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

UrbanCode Deploy

unaffected

Version	Status	Constraints
7.1	affected	<=7.1.2.14
7.2	affected	<=7.2.3.7
7.3	affected	<=7.3.2.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-46474
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/265512
vdb-entryVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/7096546
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-46474		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/265512		vdb-entryVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/7096546		vendor-advisoryVendor Advisory