IBM Business Automation Workflow and Enterprise Service Bus Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability has been identified in IBM Business Automation Workflow and IBM Business Automation Workflow Enterprise Service Bus, specifically in versions 24.0.0, 24.0.1, and earlier unsupported versions. This vulnerability allows authenticated users to inject arbitrary JavaScript into the Web UI, potentially altering functionality and leading to credential disclosure within a trusted session.

Impact

Exploitation of this vulnerability could result in cross-site scripting, allowing for the injection of malicious scripts that could be executed in the context of the user's session.

Remediation

Users are advised to upgrade to version 24.0.1 or to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR DT419006. For earlier unsupported versions, upgrade to a long-term support release or the latest SSCD version.