EUVD-2026-83140
GHSA-m729-455r-m59h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable unauthenticated XSS (PR:N) requiring victim interaction (UI:R); script runs cross-context (S:C) with Low confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
AnalysisAI
Cross-site scripting in the IBM Common Licensing Agent and ART Web UI (9.0, 9.0.0.1, 9.0.0.2) lets an unauthenticated attacker embed arbitrary JavaScript into the interface, which executes in the browser of any user who is lured into rendering the crafted content; because the script runs inside a trusted, authenticated licensing session, the realistic outcome is theft of that session's credentials or manipulation of the displayed licensing data. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) confirms no attacker authentication is needed but that exploitation depends on victim interaction, and the changed scope indicates the injected payload can affect resources beyond the vulnerable component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an attacker to inject JavaScript into the Common Licensing Agent / ART Web UI and then induce an authenticated user to render the crafted content (UI:R) - exploitation only yields meaningful impact when the victim already has a trusted, authenticated Web UI session in which the injected script runs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but modest-severity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: IBM has released IBM Common Licensing including the Agent and ART 9.0.x releases addressed by this advisory, and the fix is documented at https://www.ibm.com/support/pages/node/7286490 - consult that page for the exact remediation build for your installed 9.0, 9.0.0.1 or 9.0.0.2 version before upgrading, since no discrete target version number is stated in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Common Licensing
View allCross-site request forgery in IBM Common Licensing Agent and ART 9.0.x allows remote attackers to execute unauthorized a
Done. The JSON synthesis is above. Summary of the analysis: - **What it is:** An open redirect / HTTP Host header injec
IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for
IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have acce
IBM Common Licensing Agent and ART versions 9.0 through 9.0.0.2 enforce input validation only on the client side, leavin
IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user. Rated medium sev
Cross-site scripting in IBM Common Licensing Agent 9.0 through 9.0.0.2 and ART 9.0 through 9.0.0.2 lets remote, unauthen
Cross-site scripting (XSS) in the IBM Common Licensing Agent (9.0, 9.0.0.1, 9.0.0.2) and IBM ART (9.0, 9.0.0.1, 9.0.0.2)
Cross-site scripting in IBM Common Licensing Agent and ART versions 9.0, 9.0.0.1, and 9.0.0.2 allows a user who already
IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerabil
Sensitive information exposure in IBM Common Licensing Agent 9.0 through 9.0.0.2 and IBM Administration and Reporting To
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today