Financial Transaction Manager For Swift Services For Multiplatforms
Monthly
Reflected cross-site scripting in IBM Financial Transaction Manager for SWIFT Services for Multiplatforms (versions 3.2.4.0 through 3.2.4.16) lets an unauthenticated attacker inject arbitrary JavaScript into the Web UI, which then executes in the browser of any authenticated user who loads the crafted content. Because the payload runs inside a trusted, already-authenticated session, the realistic impact is disclosure of that user's credentials or session data rather than server compromise; exploitation is constrained by the mandatory requirement that a victim interact with attacker-supplied content (CVSS 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/). No public exploit code or confirmed active exploitation was identified at the time of analysis, and the vendor has published remediation guidance.
Cross-site scripting in IBM Financial Transaction Manager for SWIFT Services for Multiplatforms versions 3.2.4.0 through 3.2.4.15 permits injection of arbitrary JavaScript into the Web UI, creating a pathway to credential disclosure within an authenticated operator's session. The Changed Scope (S:C) in the CVSS vector confirms the injected script executes in the victim's browser beyond the originating application boundary, elevating real-world impact in a SWIFT financial messaging context. No public exploit has been identified and EPSS stands at 0.05% (16th percentile), reflecting low immediate exploitation probability, though a discrepancy between the CVE description characterizing the attacker as unauthenticated and the CVSS PR:L vector warrants vendor clarification before finalizing risk posture.
Reflected cross-site scripting in IBM Financial Transaction Manager for SWIFT Services for Multiplatforms (versions 3.2.4.0 through 3.2.4.16) lets an unauthenticated attacker inject arbitrary JavaScript into the Web UI, which then executes in the browser of any authenticated user who loads the crafted content. Because the payload runs inside a trusted, already-authenticated session, the realistic impact is disclosure of that user's credentials or session data rather than server compromise; exploitation is constrained by the mandatory requirement that a victim interact with attacker-supplied content (CVSS 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/). No public exploit code or confirmed active exploitation was identified at the time of analysis, and the vendor has published remediation guidance.
Cross-site scripting in IBM Financial Transaction Manager for SWIFT Services for Multiplatforms versions 3.2.4.0 through 3.2.4.15 permits injection of arbitrary JavaScript into the Web UI, creating a pathway to credential disclosure within an authenticated operator's session. The Changed Scope (S:C) in the CVSS vector confirms the injected script executes in the victim's browser beyond the originating application boundary, elevating real-world impact in a SWIFT financial messaging context. No public exploit has been identified and EPSS stands at 0.05% (16th percentile), reflecting low immediate exploitation probability, though a discrepancy between the CVE description characterizing the attacker as unauthenticated and the CVSS PR:L vector warrants vendor clarification before finalizing risk posture.