Executive Summary

CVE-2026-11372 is a Cross-Site Scripting (XSS) vulnerability affecting IBM TRIRIGA Application Platform versions 5.0.2 through 5.0.3.

This flaw allows an authenticated user to inject arbitrary malicious JavaScript code into the Web User Interface (UI).

By embedding this code, the attacker can alter the intended functionality of the application.

This can potentially lead to the disclosure of user credentials within a trusted session.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated user to inject malicious JavaScript code into the Web UI, potentially leading to credential disclosure within a trusted session.

Such credential disclosure could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive information and user credentials to maintain confidentiality and integrity.

However, the provided information does not explicitly discuss the direct impact on compliance with these standards.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing an authenticated attacker to execute malicious JavaScript code within your session.

This can alter the normal behavior of the application and potentially expose sensitive information such as user credentials.

Because the attack occurs within a trusted session, it can bypass some security controls and lead to unauthorized access or data leakage.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability in IBM TRIRIGA Application Platform versions 5.0.2 to 5.0.3, users should upgrade to version 5.0.4 or later, where the issue has been addressed.

No workarounds are available, so applying the latest maintenance and updates is the recommended immediate step to protect against this cross-site scripting vulnerability.

Useful 0 Not Useful 0