CVE-2024-35112 MEDIUM

CVE-2024-35112: IBM Control Center cross-site scripting

Vendor Ibm

Product Control Center

Weakness CWE-80 · XSS · basic

Published January 25, 2025

Last update January 27, 2025

View on NVD All CVEs

CVSS base score

5.4/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

Key dates

02Disclosure timeline

January 25, 2025 CVE published

January 27, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-35112 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/80.html

Related vulnerabilities

04Related CVE

CVE-2026-39712 WordPress tagDiv Composer plugin <= 5.4.3 - Arbitrary Shortcode Execution vulnerability CVE-2026-34033 Apache Answer: HTML Content Injection in Email CVE-2026-32753 FreeScout: Stored XSS through SVG file upload with filter bypass CVE-2026-6002 HTML Injection in DivvyDrive Information Technologies' DivvyDrive CVE-2025-15345 MapGeo - Interactive Geo Maps <= 1.6.27 - Reflected Cross-Site Scripting via 'map' Parameter