Uem
Monthly
Cross-site scripting in the BlackBerry UEM Management Console lets an attacker supply malformed input that is rendered without proper neutralization, so script executes in the browser of a logged-in administrator viewing the affected console page. The injection point is reachable without authentication (CVSS vector PR:N), but the payload only fires when a privileged console user actively interacts with the crafted content (UI:A), which is why the independent assessment rates real-world risk MODERATE rather than critical despite the vendor's 8.6 CVSS 4.0 score. Affected builds are UEM 12.23.0 QF8 and earlier plus 12.22.1 QF7 and earlier; EPSS is only 0.26 percent (17th percentile), SSVC records no observed exploitation, and no public exploit code has been identified at time of analysis.
Improper input validation in the BlackBerry UEM Management Console (versions 12.23.0 QF8 and earlier, and 12.22.1 QF7 and earlier) enables unauthenticated remote attackers to trigger arbitrary file download operations and a potential denial of service condition against the console when a Management Console user interacts with attacker-influenced content. The CVSS 4.0 vector reflects high availability impact on the vulnerable system (VA:H) with residual integrity and availability effects on subsequently managed systems (SI:L/SA:L), though the vendor rates confidentiality impact as none (VC:N) - a notable discrepancy given the 'Arbitrary File Download' language in the description that warrants vendor clarification. No public exploit code or active exploitation has been identified; EPSS places this at the 11th percentile (0.21%) and SSVC independently assesses exploitation as none with a non-automatable attack path.
Cross-site scripting in the BlackBerry UEM Management Console lets an attacker supply malformed input that is rendered without proper neutralization, so script executes in the browser of a logged-in administrator viewing the affected console page. The injection point is reachable without authentication (CVSS vector PR:N), but the payload only fires when a privileged console user actively interacts with the crafted content (UI:A), which is why the independent assessment rates real-world risk MODERATE rather than critical despite the vendor's 8.6 CVSS 4.0 score. Affected builds are UEM 12.23.0 QF8 and earlier plus 12.22.1 QF7 and earlier; EPSS is only 0.26 percent (17th percentile), SSVC records no observed exploitation, and no public exploit code has been identified at time of analysis.
Improper input validation in the BlackBerry UEM Management Console (versions 12.23.0 QF8 and earlier, and 12.22.1 QF7 and earlier) enables unauthenticated remote attackers to trigger arbitrary file download operations and a potential denial of service condition against the console when a Management Console user interacts with attacker-influenced content. The CVSS 4.0 vector reflects high availability impact on the vulnerable system (VA:H) with residual integrity and availability effects on subsequently managed systems (SI:L/SA:L), though the vendor rates confidentiality impact as none (VC:N) - a notable discrepancy given the 'Arbitrary File Download' language in the description that warrants vendor clarification. No public exploit code or active exploitation has been identified; EPSS places this at the 11th percentile (0.21%) and SSVC independently assesses exploitation as none with a non-automatable attack path.