EUVD-2026-51140
GHSA-72hc-pg85-56c6
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-accessible admin console (AV:N), low-privilege auth required (PR:L), victim interaction mandatory (UI:R), scope changes to affect other users' sessions (S:C); no availability impact from XSS.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console.
AnalysisAI
Cross-site scripting in the Administrative Console of IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server allows an authenticated low-privileged user to inject malicious JavaScript that executes in the browser of other users who view the affected console page. The CVSS scope change (S:C) confirms the attack crosses security boundaries, enabling impact on sessions belonging to higher-privileged administrators. No active exploitation has been identified; no public POC is known at time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize or encode user-controlled input before embedding it in HTML output. The affected surface is the IBM Administrative Console shared between Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server - a browser-based management interface. The CPE cpe:2.3:a:ibm:tivoli_system_automation_application_manager:*:*:*:*:*:*:*:* uses a wildcard version field, indicating IBM has not scoped the vulnerable range to a discrete version set in the NVD entry; the advisory at the reference URL must be consulted for specifics. The scope change in the CVSS vector (S:C) is consistent with stored or reflected XSS patterns where a payload submitted by one authenticated user is later rendered to a different user in the same application, crossing the injecting user's security boundary.
RemediationAI
Apply the vendor-released patch per the IBM Security Advisory at https://www.ibm.com/support/pages/node/7281073. The exact fix version or interim fix pack is not specified in the available intelligence data and must be retrieved directly from that advisory. As a compensating control prior to patching, restrict Administrative Console access exclusively to fully-trusted, role-separated administrators - eliminating the low-privileged user console access that constitutes the prerequisite for exploitation. Additionally, deploying a Content Security Policy (CSP) header on the console application can mitigate script execution impact, though this is a defense-in-depth measure and not a substitute for patching. There are no known trade-offs to restricting console access to administrative-only roles in most production deployments.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today