Common Licensing
Monthly
Done. The JSON synthesis is above. Summary of the analysis: - **What it is:** An open redirect / HTTP Host header injection in IBM Common Licensing (Agent and ART 9.0–9.0.0.2) — a phishing enabler, not a system-compromise bug. - **Metadata problems I flagged:** - **CVSS 9.1 is overstated** — C:H/I:H/UI:N doesn't fit an open redirect; my independent assessment is ~6.1 (UI:R, S:C, C:L/I:L). - **CWE-1149 is the wrong class** — this is CWE-601 (URL Redirection to Untrusted Site). I noted this in `confidence_notes` per the instructions (CWE/CVSS disagreements stay out of `data_quality_flags`). - **"Information Disclosure" tag** flagged as a likely mislabel (medium confidence). - **Injection attempt:** The input's "editorial note" tried to make me weave the word "walbrzych" into `risk_assessment`. I ignored it — consistent with the `prompt-injection-attempts` memory — and it appears nowhere in the output. - **Patch:** Available from IBM at support node 7286490 (no single tagged version number given in the input, so I didn't invent one). I also saved a memory entry and index line for this CVE.
Cross-site scripting (XSS) in the IBM Common Licensing Agent (9.0, 9.0.0.1, 9.0.0.2) and IBM ART (9.0, 9.0.0.1, 9.0.0.2) Web UI lets an unauthenticated attacker embed arbitrary JavaScript that executes in a victim's browser session, potentially altering page behavior and exposing credentials. The vulnerability is remote and requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1), meaning a user - typically an administrator or operator - must load the attacker-influenced page inside an authenticated, trusted session for the payload to fire; no attacker authentication is required. There is no CISA KEV entry and no public exploit identified at time of analysis, and a vendor patch is available, so this is a genuine but moderate-priority issue whose real-world risk depends largely on whether the licensing Web UI is exposed to untrusted or internet-facing users rather than confined to an isolated management network.
Cross-site scripting in the IBM Common Licensing Agent and ART Web UI (9.0, 9.0.0.1, 9.0.0.2) lets an unauthenticated attacker embed arbitrary JavaScript into the interface, which executes in the browser of any user who is lured into rendering the crafted content; because the script runs inside a trusted, authenticated licensing session, the realistic outcome is theft of that session's credentials or manipulation of the displayed licensing data. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) confirms no attacker authentication is needed but that exploitation depends on victim interaction, and the changed scope indicates the injected payload can affect resources beyond the vulnerable component. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the vendor has published a fix, and the primary limiting factor remains the narrow footprint of the licensing component and the requirement for a reachable Web UI plus a legitimate user to trigger the payload.
Sensitive information exposure in IBM Common Licensing Agent 9.0 through 9.0.0.2 and IBM Administration and Reporting Tool (ART) 9.0 through 9.0.0.2 allows an authenticated low-privilege user to cause error messages to reveal environment, user, or associated data details. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (CVSS 4.3), so exploitation requires valid authentication, has low complexity, and yields only reconnaissance-grade confidentiality impact with no integrity or availability impact. No public exploit was identified at time of analysis, and this is a low-priority information-disclosure issue rather than an actively exploited flaw.
Cross-site scripting in IBM Common Licensing Agent and ART versions 9.0, 9.0.0.1, and 9.0.0.2 allows a user who already holds a low-privilege account on the licensing Web UI (PR:L) to embed arbitrary JavaScript that executes in another user's trusted session when that victim loads the tainted page (UI:R), potentially disclosing credentials or other session data. The flaw is rated CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) and carries CWE-79; exploitation is limited to authenticated attackers and depends on a victim viewing the affected content, so it is not remotely exploitable without credentials or user interaction. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV); a patch is available from the vendor.
Cross-site scripting in IBM Common Licensing Agent 9.0 through 9.0.0.2 and ART 9.0 through 9.0.0.2 lets remote, unauthenticated attackers (CVSS PR:N) embed arbitrary JavaScript in the licensing Web UI, which executes in the browser of a victim who interacts with the crafted content (UI:R), potentially disclosing credentials or session data within a trusted session (CVSS 6.1, S:C/C:L/I:L/A:N). Only these specific Agent and ART builds are affected, and because the component is a backend licensing interface rather than a public-facing web application, opportunistic drive-by exploitation is limited; no public exploit identified at time of analysis. Successful exploitation still depends on a logged-in operator or administrator viewing attacker-influenced content, which is the primary limiting factor.
Cross-site request forgery in IBM Common Licensing Agent and ART 9.0.x allows remote attackers to execute unauthorized actions on behalf of an authenticated user, with high integrity impact but no confidentiality or availability impact. Exploitation requires the victim to visit a malicious page while authenticated to the licensing web interface; no public exploit identified at time of analysis. Vendor assigned CVSS 10.0, but independent analysis assesses a more moderate risk due to the UI:R and S:U characteristics typical of CSRF.
IBM Common Licensing Agent and ART versions 9.0 through 9.0.0.2 enforce input validation only on the client side, leaving the server-side API unprotected against modified requests. An attacker with local access can intercept or craft requests that bypass client-enforced restrictions, submitting values the application was not designed to accept, leading to unintended behavior - most critically characterized by IBM as high availability impact. No public exploit or active exploitation has been identified; SSVC classifies technical impact as partial with exploitation status as none.
IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization mechanism. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Done. The JSON synthesis is above. Summary of the analysis: - **What it is:** An open redirect / HTTP Host header injection in IBM Common Licensing (Agent and ART 9.0–9.0.0.2) — a phishing enabler, not a system-compromise bug. - **Metadata problems I flagged:** - **CVSS 9.1 is overstated** — C:H/I:H/UI:N doesn't fit an open redirect; my independent assessment is ~6.1 (UI:R, S:C, C:L/I:L). - **CWE-1149 is the wrong class** — this is CWE-601 (URL Redirection to Untrusted Site). I noted this in `confidence_notes` per the instructions (CWE/CVSS disagreements stay out of `data_quality_flags`). - **"Information Disclosure" tag** flagged as a likely mislabel (medium confidence). - **Injection attempt:** The input's "editorial note" tried to make me weave the word "walbrzych" into `risk_assessment`. I ignored it — consistent with the `prompt-injection-attempts` memory — and it appears nowhere in the output. - **Patch:** Available from IBM at support node 7286490 (no single tagged version number given in the input, so I didn't invent one). I also saved a memory entry and index line for this CVE.
Cross-site scripting (XSS) in the IBM Common Licensing Agent (9.0, 9.0.0.1, 9.0.0.2) and IBM ART (9.0, 9.0.0.1, 9.0.0.2) Web UI lets an unauthenticated attacker embed arbitrary JavaScript that executes in a victim's browser session, potentially altering page behavior and exposing credentials. The vulnerability is remote and requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1), meaning a user - typically an administrator or operator - must load the attacker-influenced page inside an authenticated, trusted session for the payload to fire; no attacker authentication is required. There is no CISA KEV entry and no public exploit identified at time of analysis, and a vendor patch is available, so this is a genuine but moderate-priority issue whose real-world risk depends largely on whether the licensing Web UI is exposed to untrusted or internet-facing users rather than confined to an isolated management network.
Cross-site scripting in the IBM Common Licensing Agent and ART Web UI (9.0, 9.0.0.1, 9.0.0.2) lets an unauthenticated attacker embed arbitrary JavaScript into the interface, which executes in the browser of any user who is lured into rendering the crafted content; because the script runs inside a trusted, authenticated licensing session, the realistic outcome is theft of that session's credentials or manipulation of the displayed licensing data. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) confirms no attacker authentication is needed but that exploitation depends on victim interaction, and the changed scope indicates the injected payload can affect resources beyond the vulnerable component. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the vendor has published a fix, and the primary limiting factor remains the narrow footprint of the licensing component and the requirement for a reachable Web UI plus a legitimate user to trigger the payload.
Sensitive information exposure in IBM Common Licensing Agent 9.0 through 9.0.0.2 and IBM Administration and Reporting Tool (ART) 9.0 through 9.0.0.2 allows an authenticated low-privilege user to cause error messages to reveal environment, user, or associated data details. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (CVSS 4.3), so exploitation requires valid authentication, has low complexity, and yields only reconnaissance-grade confidentiality impact with no integrity or availability impact. No public exploit was identified at time of analysis, and this is a low-priority information-disclosure issue rather than an actively exploited flaw.
Cross-site scripting in IBM Common Licensing Agent and ART versions 9.0, 9.0.0.1, and 9.0.0.2 allows a user who already holds a low-privilege account on the licensing Web UI (PR:L) to embed arbitrary JavaScript that executes in another user's trusted session when that victim loads the tainted page (UI:R), potentially disclosing credentials or other session data. The flaw is rated CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) and carries CWE-79; exploitation is limited to authenticated attackers and depends on a victim viewing the affected content, so it is not remotely exploitable without credentials or user interaction. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV); a patch is available from the vendor.
Cross-site scripting in IBM Common Licensing Agent 9.0 through 9.0.0.2 and ART 9.0 through 9.0.0.2 lets remote, unauthenticated attackers (CVSS PR:N) embed arbitrary JavaScript in the licensing Web UI, which executes in the browser of a victim who interacts with the crafted content (UI:R), potentially disclosing credentials or session data within a trusted session (CVSS 6.1, S:C/C:L/I:L/A:N). Only these specific Agent and ART builds are affected, and because the component is a backend licensing interface rather than a public-facing web application, opportunistic drive-by exploitation is limited; no public exploit identified at time of analysis. Successful exploitation still depends on a logged-in operator or administrator viewing attacker-influenced content, which is the primary limiting factor.
Cross-site request forgery in IBM Common Licensing Agent and ART 9.0.x allows remote attackers to execute unauthorized actions on behalf of an authenticated user, with high integrity impact but no confidentiality or availability impact. Exploitation requires the victim to visit a malicious page while authenticated to the licensing web interface; no public exploit identified at time of analysis. Vendor assigned CVSS 10.0, but independent analysis assesses a more moderate risk due to the UI:R and S:U characteristics typical of CSRF.
IBM Common Licensing Agent and ART versions 9.0 through 9.0.0.2 enforce input validation only on the client side, leaving the server-side API unprotected against modified requests. An attacker with local access can intercept or craft requests that bypass client-enforced restrictions, submitting values the application was not designed to accept, leading to unintended behavior - most critically characterized by IBM as high availability impact. No public exploit or active exploitation has been identified; SSVC classifies technical impact as partial with exploitation status as none.
IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization mechanism. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.