CVE-2025-33128: IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities HTML / XSS Injection observed
IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Other sources
IBM Engineering Workflow Management is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Engineering Workflow Managementto a version that resolves this vulnerability.Fixed in 7.0.3Patch iFix021 - Upgrade
Upgrade
IBM Engineering Workflow Managementto a version that resolves this vulnerability.Fixed in 7.1.0Patch iFix008
Event History
Frequently Asked Questions
What is the severity of CVE-2025-33128?
The severity of CVE-2025-33128 is medium with a score of 5.4.
How do I fix CVE-2025-33128?
To fix CVE-2025-33128, users should upgrade to IBM Engineering Workflow Management version 7.0.3 Interim Fix 021 or 7.1 Interim Fix 008.
What type of vulnerability is CVE-2025-33128?
CVE-2025-33128 is a cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2025-33128?
CVE-2025-33128 affects authenticated users of IBM Engineering Workflow Management versions 7.0.3 and 7.1.
What impact does CVE-2025-33128 have?
CVE-2025-33128 allows an authenticated user to embed arbitrary JavaScript code in the Web UI, potentially altering intended functionality.