EUVD-2026-83136
GHSA-hgr9-85h8-464w
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Authenticated Web UI user injects script (PR:L), a victim must render it (UI:R), script runs cross-context (S:C) with limited confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
AnalysisAI
Cross-site scripting in IBM Common Licensing Agent and ART versions 9.0, 9.0.0.1, and 9.0.0.2 allows a user who already holds a low-privilege account on the licensing Web UI (PR:L) to embed arbitrary JavaScript that executes in another user's trusted session when that victim loads the tainted page (UI:R), potentially disclosing credentials or other session data. The flaw is rated CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) and carries CWE-79; exploitation is limited to authenticated attackers and depends on a victim viewing the affected content, so it is not remotely exploitable without credentials or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated session to the IBM Common Licensing / ART Web UI (PR:L) to inject the JavaScript payload, and requires a second user to load the affected page (UI:R) for the script to execute in their trusted session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity stored/reflected cross-site scripting flaw (CWE-79) with a vendor CVSS 3.1 of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor patch for IBM Common Licensing Agent/ART as described in IBM's advisory at https://www.ibm.com/support/pages/node/7286490 (patch available per vendor advisory; the advisory is the authoritative source for the exact fixed build for each 9.0.x level, so confirm the corrected level there before upgrading). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Common Licensing
View allCross-site request forgery in IBM Common Licensing Agent and ART 9.0.x allows remote attackers to execute unauthorized a
Done. The JSON synthesis is above. Summary of the analysis: - **What it is:** An open redirect / HTTP Host header injec
IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for
IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have acce
IBM Common Licensing Agent and ART versions 9.0 through 9.0.0.2 enforce input validation only on the client side, leavin
IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user. Rated medium sev
Cross-site scripting in the IBM Common Licensing Agent and ART Web UI (9.0, 9.0.0.1, 9.0.0.2) lets an unauthenticated at
Cross-site scripting in IBM Common Licensing Agent 9.0 through 9.0.0.2 and ART 9.0 through 9.0.0.2 lets remote, unauthen
Cross-site scripting (XSS) in the IBM Common Licensing Agent (9.0, 9.0.0.1, 9.0.0.2) and IBM ART (9.0, 9.0.0.1, 9.0.0.2)
IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerabil
Sensitive information exposure in IBM Common Licensing Agent 9.0 through 9.0.0.2 and IBM Administration and Reporting To
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today