description: The IBM FlashSystem 900 user management GUI is vulnerable to stored cross-site scripting in code versions 1.5.2.8 and prior and 1.6.1.2 and prior. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
problem types: Cross-Site Scripting
affected:
{
product: FlashSystem 900
vendor: IBM
versions:
status: affected, version: 1.6.1.2
status: affected, version: 1.5.2.8
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: HIGH
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: CHANGED
temporalScore: 6.1
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.0/A:N/UI:N/S:C/AC:L/I:L/PR:L/AV:N/C:L/RL:O/RC:C/E:H
version: 3.0
]