EUVD-2026-15987
GHSA-34x7-hfp2-rc4v
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N reflects a network-accessible vulnerability requiring low attack complexity and authenticated privileges (PR:L), with user interaction required (UI:R). The scope change (S:C) indicates the vulnerability can impact resources beyond the vulnerable component. While the severity is moderate, the real-world risk is elevated because: (1) authenticated XSS on enterprise governance platforms poses significant credential theft risk; (2) the availability of a vendor patch from IBM indicates the vendor has confirmed the vulnerability; (3) InfoSphere is deployed in regulated industries (finance, healthcare) where session hijacking could enable regulatory violations; (4) the low complexity and network accessibility mean exploitation is straightforward for any authenticated user. This is a legitimate priority issue that warrants prompt patching, particularly in sensitive environments. |
| Exploit ScenarioDerived | An authenticated data steward with legitimate access to the InfoSphere Web UI crafts a malicious URL containing JavaScript payload in a user input field (e.g., a comment, tag, or metadata description field) that reflects the payload back to other users viewing that resource. When an administrator clicks the link or views the affected resource, the JavaScript executes in their browser session, stealing their authentication token and credentials stored in form fields. The attacker then uses the stolen token to access sensitive data catalogs, modify business rules, or alter data lineage documentation with administrative privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 contain a stored or reflected cross-site scripting (XSS) vulnerability in the Web UI that allows authenticated users to inject arbitrary JavaScript code. An attacker with valid credentials can exploit this vulnerability to steal session tokens, capture credentials entered by other users, or perform actions on behalf of compromised administrators within a trusted session, potentially leading to unauthorized access to sensitive data integration and metadata management systems.
RemediationAI
Upgrade IBM InfoSphere Information Server to version 11.7.1.7 or later immediately using the patch available from IBM at https://www.ibm.com/support/pages/node/7266764. Until patching can be completed, implement compensating controls by restricting access to the InfoSphere Web UI to a whitelist of trusted IP ranges using a reverse proxy or firewall rules, enforce HTTPS with HSTS headers to prevent downgrade attacks, disable browser JavaScript caching, and conduct an access review to remove unnecessary user privileges. Audit all recent Web UI activity logs for indicators of XSS payload injection or suspicious script execution patterns.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which represents a failure to properly sanitize or encode user-supplied input before rendering it in HTML/JavaScript contexts. The affected product, IBM InfoSphere Information Server (CPE: cpe:2.3:a:ibm:infosphere_information_server), is an enterprise data integration and governance platform that exposes administrative and operational functionality through a Web UI. The vulnerability exists in the Web UI layer where user input is processed and reflected or stored without adequate output encoding, allowing malicious JavaScript payloads to execute in the browser context of other users accessing the same application.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session
Executive ViewAI
Organizations using IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 should be aware of moderate risk from CVE-2026-2484, a cross-site scripting vulnerability rated CVSS 4.3. Attackers could inject scripts to steal sessions or perform actions as authenticated users. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB