title: IBM Power Hardware Management Console cross-site scripting
description: IBM Power HMC 7.1.0 through 7.8.0 and 7.3.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  91163.
problem types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
defaultStatus: unaffected
product: Power HMC
vendor: IBM
versions:
lessThanOrEqual: 7.8.0, status: affected, version: 7.1.0, versionType: semver
status: affected, version: 7.3.5
}
metrics:
cvssV2_0: [
accessComplexity: MEDIUM
accessVector: NETWORK
authentication: NONE
availabilityImpact: NONE
baseScore: 4.3
confidentialityImpact: NONE
integrityImpact: PARTIAL
vectorString: AV:N/AC:M/Au:N/C:N/I:P/A:N
version: 2.0
]
format: CVSS
scenarios: GENERAL