The vulnerability is a cross‑site scripting flaw that allows an unauthenticated attacker to embed arbitrary JavaScript code into the IBM DOORS Web UI, potentially hijacking user sessions or stealing credentials while users are logged in. The flaw arises because the application does not properly encode or validate user input before rendering it in the page, leading to the execution of attacker‑controlled scripts in the context of privileged users. This can compromise the confidentiality of stored credentials and other sensitive data presented in the UI.

IBM Engineering Requirements Management DOORS and DOORS Web Access versions 9.6.1.1 through 9.6.1.13 and 9.7.2.1 through 9.7.2.11 are affected. These versions are subsumed under the CPE string entries for IBM DOORS and DOORS Web Access and are listed as vulnerable in the related advisories.

The CVSS score of 6.1 indicates a medium severity vulnerability with moderate exploitation complexity. The EPSS score is < 1%, so the estimated exploitation probability is very low. The vulnerability is not cataloged in the CISA KEV, suggesting it has not yet been observed in widespread exploitation. Based on the description, the likely attack vector is remote via the web UI, with no authentication required, allowing attackers to deliver malicious code through crafted requests.