CVE-2024-28772: IBM Security Directory Integrator cross-site scripting

Reference Links

• https://www.ibm.com/support/pages/node/7161448 (Advisory)
• https://exchange.xforce.ibmcloud.com/vulnerabilities/285645

Parent vulnerabilities

(Appears in the following advisories)

• IBM-7161448

Frequently Asked Questions

• What is the severity of CVE-2024-28772?

  CVE-2024-28772 has been categorized as a moderate severity vulnerability due to its potential to execute arbitrary JavaScript code in the Web UI.

• How do I fix CVE-2024-28772?

  To fix CVE-2024-28772, update IBM Security Directory Integrator to a version above 7.2.0 or IBM Security Verify Directory Integrator to a version above 10.0.0.

• What types of systems are affected by CVE-2024-28772?

  CVE-2024-28772 affects IBM Security Directory Integrator versions up to 7.2.0 and IBM Security Verify Directory Integrator versions up to 10.0.0.

• What kind of attack can exploit CVE-2024-28772?

  CVE-2024-28772 can be exploited through stored cross-site scripting attacks which allow attackers to execute malicious scripts in the context of the user's session.

• Is user action required to exploit CVE-2024-28772?

  Yes, user action is required to exploit CVE-2024-28772, as the attacker needs to convince a user to interact with a maliciously crafted input in the Web UI.