Description
Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0.0 before SP2 EP29, 6.0.4 before 6.0.4.6 iFix3, 6.0.5 before 6.0.5.9 iFix2, 6.1.0 before 6.1.0.1 iFix1, and 6.1.1 before 6.1.1.1 iFix1; and IBM Care Management 6.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 110604.
References (2)
Core 2
Core References
VDB Entry, Vendor Advisory vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/110604
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21981103
Scores
CVSS v3
5.4
EPSS
0.0085
EPSS Percentile
54.3%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (8)
ibm/care_management
6.0
ibm/curam_social_program_management
6.0 sp1 (2 CPE variants)
ibm/curam_social_program_management
6.0.0
ibm/curam_social_program_management
6.1.0.0
ibm/curam_social_program_management
6.1.0.1
ibm/curam_social_program_management
6.1.1.0
ibm/curam_social_program_management
6.1.1.1
ibm/curam_social_program_management
6.0.4.0 - 6.0.4.6
Published
Mar 12, 2018
Tracked Since
Feb 18, 2026