IBM Engineering Workflow Management CVE-2025-33128

Exploitation requires the attacker to hold a valid, authenticated EWM account with at least low-privilege access (PR:L per CVSS) sufficient to submit input into the Web UI - for example, the ability to create or edit work items, comments, or other text fields rendered in the application. A second user (the victim) must subsequently load or interact with the page containing the injected payload (UI:R), making this a social-engineering-assisted or workflow-dependent attack; the attacker cannot unilaterally trigger execution against a victim. The application must be network-accessible to both attacker and victim (AV:N). No special non-default configuration is required beyond having an authenticated session. Exploitation is limited by the need for a legitimate EWM account, the dependency on victim interaction with the injected content, and the medium CVSS integrity/confidentiality impact scores (C:L/I:L), which bound the immediate data exposure to what is accessible within the victim's active session.

The NVD CVSS 3.1 base score of 5.4 (Medium) is appropriate given the required authentication (PR:L) and victim interaction (UI:R), both of which meaningfully reduce exploitability compared to unauthenticated or no-click XSS. The attack vector is network (AV:N) with low complexity (AC:L), meaning any authenticated EWM user on the network can attempt the attack without special conditions. The scope change (S:C) elevates real-world impact beyond the raw score suggests: credential disclosure within a trusted session - against, for example, a project administrator - can facilitate privilege escalation or lateral movement within the ALM environment. No EPSS score was provided in the intelligence data, but the absence of KEV listing and public exploit code suggests this is not currently under mass exploitation. Priority should be elevated for organizations where EWM manages sensitive development data or integrates with CI/CD credentials stores. The conflicting signals here are a medium CVSS score against a meaningful credential-theft consequence - defenders should weight the business sensitivity of EWM data when triaging.

An attacker with a standard EWM developer account crafts a work item comment or rich-text field containing an obfuscated JavaScript payload designed to exfiltrate the session cookie or capture form-submitted credentials. When a project administrator reviews the work item - a routine workflow action - the script silently executes in their browser session and transmits authentication tokens to an attacker-controlled endpoint. No public proof-of-concept code for this specific CVE has been identified at time of analysis, but the attack technique is well-understood for stored XSS in collaborative web applications.