EUVD-2025-210544
GHSA-5vrv-g57r-g2x8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered XSS requires no authentication but mandates victim interaction; scope change reflects browser session impact; no availability effect.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
AnalysisAI
Cross-site scripting in IBM Engineering Requirements Management DOORS Web Access allows unauthenticated remote attackers to inject arbitrary JavaScript into the Web UI by tricking an authenticated user into interacting with a malicious payload, potentially resulting in credential disclosure within a trusted session. Affected versions span two maintained branches: 9.7.2.1-9.7.2.11 and 9.6.1.1-9.6.1.13. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, and IBM has released a patch via advisory 7279145.
Technical ContextAI
IBM Engineering Requirements Management DOORS (Design Object Oriented Requirements System) is a requirements management platform widely deployed in regulated industries such as aerospace and defense. The DOORS Web Access (DWA) component exposes a browser-based interface to the underlying DOORS repository. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input is reflected or rendered in the web interface without adequate sanitization or output encoding, enabling injection of client-side script. The CVSS scope-change indicator (S:C) confirms that the injected script executes in the victim's browser context rather than on the server, crossing the security boundary from the web application to the authenticated user's session. The CPE string 'cpe:2.3:a:ibm:engineering_requirements_management_doors_and_doors_web_access' confirms both the DOORS classic and Web Access components are within scope.
RemediationAI
IBM has released a patch and organizations should apply it immediately by consulting the vendor advisory at https://www.ibm.com/support/pages/node/7279145 for the exact fixed build number in each branch. Until patching is complete, reduce exposure by restricting DOORS Web Access to internal network segments or VPN-authenticated connections only, which eliminates the network-reachable attack vector and prevents unauthenticated attackers from delivering XSS payloads to users. Additionally, deploying a web application firewall (WAF) with XSS filtering rules in front of DOORS Web Access can intercept common injection patterns, though WAF bypass remains possible and this is a compensating control only. User awareness training to avoid clicking unsolicited DOORS Web Access links is a low-cost supplementary measure. The exact patched version is not independently confirmed beyond the IBM advisory reference - verify the specific fixed build with IBM support before marking remediated.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today