Cross-Site Scripting in IBM Engineering Workflow Management

Compliance Impact

The vulnerability allows an authenticated user to inject arbitrary JavaScript code into the Web UI, potentially leading to credential disclosure within a trusted session.

Such credential disclosure risks can impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and user credentials.

However, the provided information does not explicitly discuss the direct impact on compliance with these standards or regulations.

Useful 0 Not Useful 0

Executive Summary

CVE-2025-33128 is a cross-site scripting (XSS) vulnerability in IBM Engineering Workflow Management versions 7.0.3 through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007.

This vulnerability allows an authenticated user to inject arbitrary JavaScript code into the Web UI, which can alter the intended functionality of the application.

Such injection can potentially lead to the disclosure of credentials within a trusted session.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing an authenticated user to execute arbitrary JavaScript code in the Web UI.

This can alter the intended functionality of the application and potentially lead to the disclosure of sensitive information such as user credentials.

Because the attack occurs within a trusted session, it can compromise the security of user accounts and the integrity of the system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability CVE-2025-33128 in IBM Engineering Workflow Management, you should apply the provided fixes from IBM.

• For version 7.0.3, apply Interim Fix 021.
• For version 7.1.0, apply Interim Fix 008.

No workarounds are currently available, so applying these fixes is the recommended immediate action.

Useful 0 Not Useful 0