CVE-2025-36352
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
IBM License Metric Tool 9.2.0 through 9.2.40 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Risk Assessment
The organization may be exposed to XSS attacks that could lead to credential theft or unauthorized actions within a trusted user session.
Recommendation
Update IBM License Metric Tool to the latest version and implement input sanitization mechanisms in the Web UI.
Other vulnerabilities in IBM License Metric Tool
Original NVD description (English source)
IBM License Metric Tool 9.2.0 through 9.2.40 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS