EUVD-2026-38631
GHSA-r6vh-m36j-r62m
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
PR:H reflects required high-privilege access to config fields; UI:R corrects the vendor vector since a victim must actively view the Asset View page for stored payload execution.
Primary rating from Vendor (Fortra).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-site scripting (XSS) vulnerability in the Asset View UI component. An authenticated user with sufficient privileges to create or modify affected node or database configuration fields could store script content that may be rendered as HTML instead of safely escaped text when the affected Asset View UI content is displayed.
AnalysisAI
Stored cross-site scripting in Fortra File Integrity Monitoring (FIM) versions prior to 9.4.0.1 allows a highly privileged authenticated user to inject persistent script content into node or database configuration fields within the Asset View UI component. When another user subsequently views the affected Asset View page, the stored payload executes in their browser context rather than being safely escaped, enabling session hijacking, credential theft, or unauthorized UI manipulation against that victim. No public exploit code has been identified and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) describes a failure to sanitize or encode user-supplied data before it is rendered in a web page. In this case, Fortra FIM's Asset View UI component accepts text input for node or database configuration fields from privileged users but fails to HTML-encode or Content Security Policy-restrict that content at render time, so stored values are interpreted as executable HTML/JavaScript by the victim's browser rather than displayed as inert text. Fortra FIM is the rebranded successor to Tripwire Enterprise, a file integrity monitoring and security configuration management platform used in regulated enterprise environments. The affected CPE is cpe:2.3:a:fortra:fortra_file_integrity_monitoring_(fim):*:*:*:*:*:*:*:* for all versions prior to 9.4.0.1. The scope change (S:C in the CVSS vector) reflects the classic stored XSS dynamic: the attacker operates in one security boundary (the configuration editor) but the injected content executes in a different boundary (another user's authenticated browser session).
RemediationAI
The primary fix is to upgrade Fortra FIM to version 9.4.0.1 or later, as confirmed in the vendor advisory at https://www.fortra.com/security/advisories/product-security/fi-2026-009. If immediate upgrade is not feasible, restrict write access to node and database configuration fields within the Asset View UI to the smallest possible set of highly trusted accounts, thereby reducing the attacker population that could store malicious content. Additionally, enforce a Content Security Policy header on the FIM web interface if the product supports custom HTTP response headers, to limit the impact of any XSS payload execution. Audit existing configuration fields for unexpected script content as a detection measure. Note that restricting privileges as a compensating control does not eliminate the vulnerability for accounts that legitimately require configuration access.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today