CVE-2022-30611

Vulnerability

IBM Spectrum Copy Data Management versions 2.2.0.0 through 2.2.15.0 are vulnerable to stored cross-site scripting (XSS) due to improper validation of user-supplied input. The vulnerability exists in certain form fields within the portal user interface. An attacker can inject malicious script into a web page that will be executed in the context of the victim's browser when the page is viewed [1].

Exploitation

A remote attacker with network access to the affected portal UI can craft a malicious input in one of the vulnerable form fields. The attacker does not require authentication to inject the payload, though user interaction is required—the victim must view the page containing the injected script. The injected script is stored and executed when other users navigate to that page [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser within the security context of the Spectrum Copy Data Management web application. This can be used to steal the victim's cookie-based authentication credentials, leading to session hijacking and unauthorized access to the application [1].

Mitigation

IBM has released a fix as part of IBM Spectrum Copy Data Management version 2.2.16.0 or later. Users should upgrade to the latest version to mitigate this vulnerability. No workarounds are documented in the available reference [1].