CVE-2024-28772: IBM Security Directory Integrator cross-site scripting
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 285645.
Other sources
IBM Security Directory Integrator is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28772?
CVE-2024-28772 has been categorized as a moderate severity vulnerability due to its potential to execute arbitrary JavaScript code in the Web UI.
How do I fix CVE-2024-28772?
To fix CVE-2024-28772, update IBM Security Directory Integrator to a version above 7.2.0 or IBM Security Verify Directory Integrator to a version above 10.0.0.
What types of systems are affected by CVE-2024-28772?
CVE-2024-28772 affects IBM Security Directory Integrator versions up to 7.2.0 and IBM Security Verify Directory Integrator versions up to 10.0.0.
What kind of attack can exploit CVE-2024-28772?
CVE-2024-28772 can be exploited through stored cross-site scripting attacks which allow attackers to execute malicious scripts in the context of the user's session.
Is user action required to exploit CVE-2024-28772?
Yes, user action is required to exploit CVE-2024-28772, as the attacker needs to convince a user to interact with a maliciously crafted input in the Web UI.