CVE-2025-1997CWE-80

IBM UrbanCode Deploy (UCD) / IBM DevOps Deploy HTML injection

Medium · published March 27, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 and 8.1 through 8.1

is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00288 · 20.2th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2025-03-27T14:39Z
EPSS history
Timeline
  • 27 MAR 14:39Z
    IBM UrbanCode Deploy (UCD) / IBM DevOps Deploy HTML injection
    cvelistv5