CVE-2020-4792

Vulnerability

IBM Edge version 4.2 is vulnerable to cross-site scripting (XSS) in the Web UI. The vulnerability allows users to embed arbitrary JavaScript code, altering intended functionality. The affected product is IBM Edge 4.2 [1].

Exploitation

An attacker with low-privileged access (authenticated user) can inject malicious scripts into the Web UI. The attack requires user interaction (the victim must view the crafted page). The CVSS vector indicates network access, low complexity, and required user interaction [1].

Impact

Successful exploitation could lead to credentials disclosure within a trusted session. The attacker can execute arbitrary JavaScript in the context of the victim's session, potentially stealing session cookies or performing actions on behalf of the victim. The CVSS score is 5.4 (medium) with impacts to confidentiality and integrity [1].

Mitigation

IBM has released a fix in the form of updated Docker images that are automatically pulled from Docker Hub and the IBM Entitled Registry. Users should ensure they are running the latest images. No workarounds are available [1].