CVE-2026-3303: IBM Concert Software Permissive Cross-domain Security Policy
IBM Concert
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Concertto a version that resolves this vulnerability.Fixed in 3.0.1.1
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that exploitation is network-accessible and does not require prior privileges or user interaction. However, the attack complexity is rated high.
What security impact is described?
An attacker may be able to perform privileged actions through the permissive cross-origin resource sharing policy. The stated CVSS impact is limited to low confidentiality impact, with no integrity or availability impact listed.
Which IBM Concert versions are affected?
IBM Concert versions 1.0 through 3.0.0 are identified as affected.
What configuration condition creates the exposure?
The exposure is associated with CORS allowing domain names that are not restricted to trusted domains. Systems using a permissive cross-domain policy are therefore within the described risk condition.