EUVD-2026-83311
GHSA-92hg-9mjw-cm5q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Authenticated XSS (PR:L) executing in a victim's browser requires the victim to render content (UI:R); browser-context script yields C:L/I:L, scope change S:C, no availability impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
3DescriptionCVE.org
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.
AnalysisAI
Stored cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated user of the web management console inject script that executes in a second user's browser when the affected page is rendered. The vendor scores this 9.6 (scope change, high confidentiality and integrity impact), but the independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, treating the impact as confined to the victim's browser/session context rather than the underlying appliance operating system; the record's 'RCE' tag and the vendor's UI:N rating overstate what a CWE-79 input-neutralization flaw realistically delivers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated session on the IBM Guardium Data Protection 12.2 web console (PR:L) to inject the payload, and realistically a second victim user to view the affected page for the script to execute in their browser. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a high-CVSS-but-lower-real-risk issue where the vendor scoring and tags overstate severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status: patch available per vendor advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm all instances of IBM Guardium Data Protection 12.2, restrict management console access to trusted administrators, review console logs for suspicious stored content or unexpected script-related activity, and apply the patch available per vendor advisory for IBM Guardium Data Protection 12.2 as soon as change control permits; within 7 days, apply the patch to every remaining IBM Guardium Data Protection 12.2 deployment, enforce multi-factor authentication and least privilege for console users, and validate that input neutralization prevents stored script execution; within 30 days, verify full remediation across the environment, re-audit user roles and session controls, and monitor for any recurrence or anomalous console behavior.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Guardium Data Protection
View allSQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
Second-order SQL injection in IBM Guardium Data Protection 12.2 allows an unauthenticated remote attacker to submit SQL
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows a remote attacker to execute u
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today