Description
IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS breakdown
CVSS 3.0
Privileges Required
None
Attack Vector
Network
Scope
Changed
Availability
None
Integrity
Low
User Interaction
Required
Attack Complexity
Low
Confidentiality
Low
RC
Changed
RL
O
E
High
Affected products
- ibm / Security Key Lifecycle Manager2.6 – 2.6
- ibm / Security Key Lifecycle Manager2.7 – 2.7
- ibm / Security Key Lifecycle Manager3.0 – 3.0
- ibm / Security Key Lifecycle Manager3.0.1 – 3.0.1