Cross-site scripting in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - CVE-2025-12635

Vulnerability identifier: #VU119901

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2025-12635

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

IBM WebSphere Application Server
IBM WebSphere Application Server Liberty
Enterprise Application Service for Java
Enterprise Application Runtimes
Operations Analytics - Log Analysis
PowerVM NovaLink
Financial Transaction Manager for RedHat OpenShift
Tivoli Network Manager IP Edition
WebSphere Hybrid Edition
Cloud Pak for Applications
IBM Tivoli Netcool Configuration Manager
Engineering Test Management
Tivoli Composite Application Manager for Application Diagnostics
Maximo Application Suite - Monitor Component
IBM OpenPages with Watson
CICS Transaction Gateway for Multiplatforms
CICS Transaction Gateway Desktop Edition
IBM MQ Appliance
DevOps Code ClearCase
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Storage Protect Client
Storage Protect for Virtual Environments: Data Protection for VMware
Storage Protect for Space Management
Storage Protect Operations Center
Robotic Process Automation for Cloud Pak
WebSphere Service Registry and Repository
IBM Business Automation Workflow
IBM Maximo Asset Management
Jazz for Service Management
IBM SPSS Analytic Server
IBM Tivoli System Automation Application Manager
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Sterling Partner Engagement Manager
IBM Tivoli Netcool Impact
IBM Cloud Application Performance Management (APM)
IBM TXSeries for Multiplatforms
IBM SPSS Collaboration and Deployment Services
WebSphere Remote Server
IBM Maximo Application Suite
IBM Rational ClearQuest
IBM Rational ClearCase
IBM Transformation Extender Advanced
Voice Gateway
Planning Analytics Local
IBM i
IBM Tivoli Application Dependency Discovery Manager
IBM License Metric Tool
IBM CICS TX Advanced
IBM CICS TX Standard
IBM InfoSphere Information Server
IBM Watson Explorer Deep Analytics Edition Foundational Components
IBM Watson Explorer Deep Analytics Edition Analytical Components

Install updates from vendor's website.

Voice Gateway - addressed in versions 1.0.8.19, 1.0.8.25
Operations Analytics - Log Analysis - update to 1.3.8.2
PowerVM NovaLink - addressed in versions 2.1.1-260428, 2.2.1.1-260428, 2.3.2-260422
Planning Analytics Local - update to 2.1.19
Financial Transaction Manager for RedHat OpenShift - update to 4.0.9.0
Tivoli Network Manager IP Edition - update to 4.2.0.23
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.1
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.6, 6.2.4.4
IBM Tivoli Netcool Configuration Manager - update to 6.4.2.23
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.19
Maximo Application Suite - Monitor Component - addressed in versions 8.10.29, 8.11.27, 9.0.19, 9.1.9
IBM Maximo Application Suite - addressed in versions 8.10.37, 8.11.34, 9.0.24, 9.1.16
IBM License Metric Tool - update to 9.2.43
IBM MQ Appliance - addressed in versions 9.4.0.20, 9.4.5.0
IBM CICS TX Advanced - update to 10.1.0.0 ifix47
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 2
IBM Watson Explorer Deep Analytics Edition Foundational Components - update to 12.0.3.21
IBM Watson Explorer Deep Analytics Edition Analytical Components - update to 12.0.3.21
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.2.1
Storage Protect Client - update to 8.2.1
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.2.1
Storage Protect for Space Management - update to 8.2.1
Storage Protect Operations Center - update to 8.2.1
IBM CICS TX Standard - update to 11.1.0.0 ifix40
Robotic Process Automation for Cloud Pak - addressed in versions 23.0.20.6, 30.0.2

• https://www.ibm.com/support/pages/node/7254078

• Cross-site scripting in IBM WebSphere Application Server and WebSphere Application Server - Liberty
• Cross-site scripting in IBM Jazz for Service Management
• Cross-site scripting in IBM Transformation Extender Advanced
• Cross-site scripting in IBM Tivoli Composite Application Manager for Application Diagnostics
• Cross-site scripting in IBM WebSphere Hybrid Edition
• Cross-site scripting in IBM Cloud Pak for Applications
• Cross-site scripting in IBM Enterprise Application Runtimes
• Cross-site scripting in IBM WebSphere Remote Server
• Cross-site scripting in IBM Maximo Asset Management
• Cross-site scripting in IBM Business Automation Workflow
• Cross-site scripting in IBM WebSphere Service Registry and Repository
• Cross-site scripting in IBM Tivoli NetCool Configuration Manager (ITNCM)
• Cross-site scripting in IBM Tivoli System Automation Application Manager
• Cross-site scripting in IBM DevOps Code ClearCase
• Cross-site scripting in IBM Enterprise Application Service for Java
• Cross-site scripting in IBM Rational ClearQuest
• IBM License Metric Tool update for IBM WebSphere Application Server
• Cross-site scripting in IBM MQ Appliance
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Cross-site scripting in IBM Tivoli Network Manager IP Edition
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM OpenPages
• Cross-site scripting in IBM Operations Analytics - Log Analysis
• Cross-site scripting in IBM Watson Explorer
• Multiple vulnerabilities in IBM TXSeries for Multiplatforms
• Multiple vulnerabilities in IBM CICS TX Advanced
• Multiple vulnerabilities in IBM SPSS Analytic Server
• Cross-site scripting in InfoSphere Information Server
• Multiple vulnerabilities in IBM CICS TX Standard
• Cross-site scripting in IBM Storage Protect Operations Center
• Cross-site scripting in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in IBM Storage Protect Backup-Archive Client, IBM Storage Protect for Virtual Environments and IBM Storage Protect for Space Management
• Multiple vulnerabilities in IBM i
• Multiple vulnerabilities in IBM Tivoli Application Dependency Discovery Manager
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition and CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in IBM Planning Analytics Local
• Cross-site scripting in IBM Tivoli Netcool Impact
• Cross-site scripting in IBM Watson Discovery Cartridge
• Cross-site scripting in IBM Engineering Test Management
• Multiple vulnerabilities in IBM Application Performance Management
• Cross-site scripting in IBM PowerVM Novalink
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager