CVE-2022-46771 MEDIUM

CVE-2022-46771: IBM UrbanCode Deploy (UCD) cross-site scripting

Vendor Ibm
Product UrbanCode Deploy (UCD)
Weakness CWE-79 · XSS
Published December 20, 2022
Last update April 16, 2025
View on NVD All CVEs

CVSS base score

4.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.18, 7.0.5.0 through 7.0.5.13, 7.1.0.0 through 7.1.2.9, 7.2.0.0 through 7.2.3.2 and 7.3.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 242273.

Key dates

02Disclosure timeline

December 20, 2022 CVE published
April 16, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-14113 Viitor Button Shortcodes <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute CVE-2022-22182 Junos OS: A XSS vulnerability allows an attacker to execute commands on a target J-Web session CVE-2025-59430 Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink CVE-2025-13839 LJUsers <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute CVE-2024-26081 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)