EUVD-2026-15984
GHSA-2g5g-hcgh-q3rp
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates network accessibility and low attack complexity, but crucially requires valid login credentials (PR:L) and user interaction (UI:R), which significantly constrains real-world exploitation. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component. The confidentiality and integrity impacts are rated as low (C:L/I:L), with no availability impact. While the CVSS score of 5.4 is moderate, the exploitation probability is relatively constrained compared to unauthenticated vulnerabilities; however, the requirement for user interaction (clicking a malicious link) combined with authentication creates a plausible attack path in scenarios involving social engineering or insider threats. The availability of a vendor patch reduces the severity of unpatched systems significantly. This should be prioritized for remediation, particularly in environments where privileged users may be targets, but it is not a critical emergency-level vulnerability. The XSS nature makes it automatable via payload injection, increasing practical risk despite authentication barriers. |
| Exploit ScenarioDerived | An attacker with valid InfoSphere credentials crafts a malicious URL containing JavaScript code injected into a Web UI parameter (for example, a search field or filter parameter) and sends it to a privileged user via email or chat. When the privileged user clicks the link while already authenticated, the JavaScript executes in their browser session, potentially stealing their session cookie, capturing credentials entered in subsequent forms, or performing administrative actions on their behalf such as creating new user accounts or modifying data integration workflows. The low attack complexity and network accessibility make this a straightforward social engineering attack once the attacker has or obtains any valid user credential. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 contain a stored or reflected cross-site scripting (XSS) vulnerability in the Web UI that allows authenticated users to inject arbitrary JavaScript code. An attacker with valid credentials can exploit this vulnerability to alter application functionality and potentially steal session credentials or perform actions on behalf of other users within a trusted browser session. A patch is available from IBM, and the vulnerability has a CVSS score of 5.4 with moderate real-world risk due to the requirement for prior authentication and user interaction.
RemediationAI
Apply the security patch provided by IBM available at https://www.ibm.com/support/pages/node/7266764. Upgrade IBM InfoSphere Information Server to a patched version, which should be version 11.7.1.7 or later, or jump to the next major version if available. Until patches can be applied, implement network segmentation to restrict access to the InfoSphere Web UI to trusted internal networks only, enforce strong authentication policies and session management to reduce the window of opportunity for XSS exploitation, and conduct user security awareness training to reduce susceptibility to social engineering attacks that leverage XSS payloads. Consider deploying a Web Application Firewall (WAF) configured to detect and block common XSS payloads in HTTP requests to the affected application.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which represents a failure in the Web UI input validation and output encoding mechanisms. The affected product is IBM InfoSphere Information Server (cpe:2.3:a:ibm:infosphere_information_server:*:*:*:*:*:*:*:*), a data integration and governance platform that processes user-supplied data in web forms and displays it without proper sanitization or HTML/JavaScript encoding. The vulnerability exists in versions 11.7.0.0 through 11.7.1.6, indicating the flaw was introduced or persisted across multiple minor versions. Attackers can inject malicious scripts through vulnerable input fields that are subsequently reflected in responses or stored in the application's state, causing execution in the context of other users' browsers when those pages are rendered.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session
Executive ViewAI
Organizations using IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 should be aware of moderate risk from CVE-2026-2483, a cross-site scripting vulnerability rated CVSS 5.4. Attackers could inject scripts to steal sessions or perform actions as authenticated users. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB