Cross-site scripting in IBM WebSphere Application Server Liberty - CVE-2025-36000

Vulnerability identifier: #VU115571

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-36000

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote privileged user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. The vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

IBM WebSphere Application Server Liberty
Log Analysis
Netcool Operations Insight
IBM Cloud Transformation Advisor
IBM Sterling Partner Engagement Manager
IBM Tivoli Netcool Impact
IBM Cloud Application Performance Management (APM)
IBM TXSeries for Multiplatforms
IBM Maximo Application Suite - Manage Component
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite
IBM Business Automation Workflow
IBM MQ Operator
IBM Sterling B2B Integrator
IBM Spectrum Symphony
Operations Analytics - Log Analysis
PowerVM NovaLink
Maximo Application Suite - Monitor Component
IBM OpenPages with Watson
Maximo Application Suite - Predict Component
Verify Identity Access Digital Credentials
Business Automation Insights
Application Modernization Accelerator
Storage Protect Operations Center
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Storage Protect for Space Management
Storage Protect for Virtual Environments: Data Protection for VMware
Storage Protect Client
IBM supplied MQ Advanced container images
IBM Tivoli Application Dependency Discovery Manager
IBM Security Verify Access
IBM Sterling File Gateway
IBM CICS TX Advanced
IBM CICS TX Standard

Cybersecurity Help is currently unaware of any official solution to address this vulnerability..

Log Analysis - update to 1.3.8.2
Operations Analytics - Log Analysis - update to 1.3.8.2
Netcool Operations Insight - update to 1.6.15
IBM Cloud Transformation Advisor - update to 4.4.0
PowerVM NovaLink - addressed in versions 2.1.1-251007, 2.2.1.1-251007, 2.3.1-251007
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
IBM Tivoli Netcool Impact - update to 7.1.0.37
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.19
IBM TXSeries for Multiplatforms - update to 11.1.0.0 ifix12
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.31, 8.7.25, 9.0.18, 9.1.5
Maximo Application Suite - Monitor Component - addressed in versions 8.10.23, 8.11.21, 9.0.13, 9.1.3
IBM Maximo Application Suite - addressed in versions 8.10.31, 8.11.28, 9.0.17, 9.1.6
Maximo Application Suite - Predict Component - update to 9.1.3
IBM Business Automation Workflow - addressed in versions 24.0.0-IF007, 24.0.1-IF005, 25.0.0-IF002
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.6, 25.0.0.0.3
IBM MQ Operator - addressed in versions 3.2.19, 3.7.2, 9.4.4.0-r3
Application Modernization Accelerator - update to 4.4.0
IBM Sterling File Gateway - addressed in versions 6.1.2.8, 6.2.0.5_1, 6.2.1.1_1, 6.2.2.0
IBM Sterling B2B Integrator - addressed in versions 6.1.2.8, 6.2.0.5_1, 6.2.1.1_1, 6.2.2.0
IBM Spectrum Symphony - update to 7.3.2 Fix 602620
Storage Protect Operations Center - update to 8.2.0
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.2.1
Storage Protect for Space Management - update to 8.2.1
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.2.1
Storage Protect Client - update to 8.2.1
IBM supplied MQ Advanced container images - update to 9.4.4.0-r3
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix43, 11.1.0.0 ifix35
IBM CICS TX Standard - update to 11.1.0.0 ifix36

• https://www.ibm.com/support/pages/node/7242026

• Cross-site scripting in IBM WebSphere Application Server Liberty
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in IBM Application Modernization Accelerator
• Multiple vulnerabilities in IBM Transformation Advisor
• Multiple vulnerabilities in IBM OpenPages
• Multiple vulnerabilities in IBM CICS TX Advanced
• Multiple vulnerabilities in IBM CICS TX Standard
• Multiple vulnerabilities in IBM TXSeries for Multiplatforms
• Multiple vulnerabilities in IBM Log Analysis
• Cross-site scripting in IBM PowerVM Novalink
• Multiple vulnerabilities in IBM Tivoli Netcool Impact
• Cross-site scripting in IBM Maximo Application Suite - Predict Component
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Tivoli Application Dependency Discovery Manager
• Multiple vulnerabilities in IBM Maximo Application Suite
• IBM Maximo Application Suite - Monitor Component update for WebSphere Application Server Liberty
• Cross-site scripting in IBM Storage Protect Operations Center
• Multiple vulnerabilities in IBM Verify Identity Access and IBM Security Verify Access
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager Essentials Edition
• Multiple vulnerabilities in IBM Spectrum Symphony
• Cross-site scripting in IBM Sterling B2B Integrator and IBM Sterling File Gateway
• Multiple vulnerabilities in IBM Business Automation Insights
• IBM Maximo Application Suite - Manage Component update for Netty
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in IBM Storage Protect Backup-Archive Client, IBM Storage Protect for Virtual Environments and IBM Storage Protect for Space Management
• Multiple vulnerabilities in IBM Application Performance Management