CVE-2025-36148

Vulnerability

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms versions 3.2.4.0 through 3.2.4.15 are vulnerable to cross-site scripting (XSS) in the Web UI. The flaw stems from improper neutralization of user input during web page generation (CWE-79) [1].

Exploitation

An unauthenticated attacker can embed arbitrary JavaScript code into the Web UI. The attacker does not require authentication, but successful exploitation relies on a trusted user interacting with the maliciously crafted content, potentially leading to credential disclosure within the same session [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session, altering intended functionality and potentially disclosing sensitive credentials. The CVSS score is 5.4 (Medium) with a vector of AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating low impact on confidentiality and integrity [1].

Mitigation

IBM strongly recommends upgrading to IBM Financial Transaction Manager for SWIFT Services for Multiplatforms Fix Pack 16 (version 3.2.4.16) to remediate this vulnerability. No workarounds are available [1].