Tivoli System Automation Application Manager
Monthly
Reflected cross-site scripting in the administrative console login page of IBM Tivoli System Automation Application Manager 4.1 (a component that also involves IBM WebSphere Application Server) allows a remote attacker to inject and execute arbitrary script in an administrator's browser session. The CVSS 3.1 vector (AV:N/PR:N/UI:R, scope-changed) yields a high 9.3 base score, but exploitation requires tricking an authenticated console user into loading a crafted URL. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Cross-site scripting in the Administrative Console of IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server allows an authenticated low-privileged user to inject malicious JavaScript that executes in the browser of other users who view the affected console page. The CVSS scope change (S:C) confirms the attack crosses security boundaries, enabling impact on sessions belonging to higher-privileged administrators. No active exploitation has been identified; no public POC is known at time of analysis.
Reflected cross-site scripting in the administrative console login page of IBM Tivoli System Automation Application Manager 4.1 (a component that also involves IBM WebSphere Application Server) allows a remote attacker to inject and execute arbitrary script in an administrator's browser session. The CVSS 3.1 vector (AV:N/PR:N/UI:R, scope-changed) yields a high 9.3 base score, but exploitation requires tricking an authenticated console user into loading a crafted URL. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Cross-site scripting in the Administrative Console of IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server allows an authenticated low-privileged user to inject malicious JavaScript that executes in the browser of other users who view the affected console page. The CVSS scope change (S:C) confirms the attack crosses security boundaries, enabling impact on sessions belonging to higher-privileged administrators. No active exploitation has been identified; no public POC is known at time of analysis.