IBM TS4500 versions 1.11.0.0-D00, 1.11.0.1-C00, 1.11.0.2-C00, and 1.10.00-F00 web GUI is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-36088 |
Exploitation
To exploit this vulnerability, an attacker must have authenticated access to the IBM TS4500 web GUI. By embedding malicious JavaScript code into the interface, the attacker can manipulate the web application and potentially extract sensitive information, such as user credentials, during a trusted session.
Affected Products
- IBM TS4500 1.11.0.0-D00: Vulnerable web GUI allowing cross-site scripting.
- IBM TS4500 1.11.0.1-C00: Same vulnerability as above.
- IBM TS4500 1.11.0.2-C00: Same vulnerability as above.
- IBM TS4500 1.10.00-F00: Same vulnerability as above.
Mitigation
To mitigate this vulnerability, it is recommended to update the IBM TS4500 web GUI to the latest version that addresses the cross-site scripting issue. Additionally, implementing strict input validation and output encoding can help prevent the injection of malicious scripts.