IBM InfoSphere Information Server Security Issues

IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 store user credentials and other sensitive information in plain text, allowing local users to read this data. This is a high-severity information disclosure vulnerability with a CVSS score of 7.1, primarily due to the potential for complete confidentiality breach across security boundaries. A patch is available from IBM, and there is no evidence of active exploitation or public proof-of-concept at this time.

IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 contain an HTTP header injection vulnerability caused by improper validation of the HOST header, allowing unauthenticated remote attackers to conduct cross-site scripting (XSS), cache poisoning, and session hijacking attacks. A vendor patch is available, and while this vulnerability is not currently listed as actively exploited in CISA's Known Exploited Vulnerabilities catalog, the CVSS score of 6.5 with network accessibility and low attack complexity indicates moderate real-world risk.

IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 contain a credential protection vulnerability that allows authenticated attackers to extract sensitive information without requiring user interaction. An attacker with valid login credentials can exploit insufficiently protected credential storage mechanisms to obtain additional sensitive data, compromising confidentiality. A patch is available from IBM, and this vulnerability affects enterprise data integration infrastructure used by organizations managing information governance and metadata.

IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 contain an information disclosure vulnerability caused by improper handling of JSON server responses, allowing authenticated attackers to expose sensitive data. The vulnerability requires low-complexity network access with valid credentials but does not require user interaction, making it accessible to any authenticated user with network connectivity. No evidence of active exploitation in the wild has been identified, though a patch is available from the vendor.

IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 fail to invalidate user sessions when administrative privileges are revoked, allowing authenticated users to retain access to sensitive information they should no longer be able to access. The vulnerability affects the session management layer and requires an authenticated attacker with initial system access. A patch is available from IBM, and this represents a privilege escalation and information disclosure risk in enterprise data integration environments.

IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 contain an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated attackers with low privileges to access sensitive information they should not be authorized to view. An attacker on the same network segment with valid user credentials can bypass authorization controls to read confidential data, though they cannot modify or delete information. A vendor patch is available, and this vulnerability should be prioritized for organizations running affected versions as it enables privilege escalation and data exfiltration within trusted network environments.

IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 contain a stored or reflected cross-site scripting (XSS) vulnerability in the Web UI that allows authenticated users to inject arbitrary JavaScript code. An attacker with valid credentials can exploit this vulnerability to alter application functionality and potentially steal session credentials or perform actions on behalf of other users within a trusted browser session. A patch is available from IBM, and the vulnerability has a CVSS score of 5.4 with moderate real-world risk due to the requirement for prior authentication and user interaction.

IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 contain a server-side request forgery (SSRF) vulnerability that allows authenticated attackers to send unauthorized requests from the affected system. This could enable network enumeration, lateral movement, or facilitate secondary attacks against internal systems. The vulnerability requires valid authentication credentials but presents moderate risk with a CVSS score of 5.4 and has an available patch from IBM.

IBM Infosphere Information Server versions 11.7.0.0 through 11.7.1.6 contain a stored cross-site scripting (XSS) vulnerability in the Web UI that allows privileged users to inject arbitrary JavaScript code, potentially leading to credential disclosure and session compromise. While a vendor patch is available, the attack requires high privileges and user interaction, resulting in a moderate CVSS score of 4.8. This vulnerability does not appear to have active exploitation in the wild or public proof-of-concept code, but should be prioritized for organizations running vulnerable versions in security-sensitive environments.

IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 contain an information disclosure vulnerability (CWE-209) that allows authenticated attackers to access sensitive information over the network without user interaction. The vulnerability has a CVSS score of 4.3 with low attack complexity and low privileges required, meaning any logged-in user can exploit it. A vendor patch is available, reducing immediate risk for organizations that can deploy updates promptly.

IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 contain a cross-site request forgery (CSRF) vulnerability in the DataStage Flow Designer component that allows unauthenticated attackers to trigger unauthorized state-changing actions on behalf of authenticated users. The vulnerability has a CVSS score of 4.3 with low attack complexity and no privileges required, though it requires user interaction (UI:R). A vendor patch is available, and this represents an integrity-focused attack vector rather than confidentiality or availability impact.

IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 contain a stored or reflected cross-site scripting (XSS) vulnerability in the Web UI that allows authenticated users to inject arbitrary JavaScript code. An attacker with valid credentials can exploit this vulnerability to steal session tokens, capture credentials entered by other users, or perform actions on behalf of compromised administrators within a trusted session, potentially leading to unauthorized access to sensitive data integration and metadata management systems.