IBM Financial Transaction Manager for SWIFT Services for Multiplatforms versions 3.2.4.0 through 3.2.4.15 contain a stored cross‑site scripting flaw (CWE‑79). An unauthenticated attacker can inject arbitrary JavaScript into the Web UI, allowing the attacker to intercept or manipulate user sessions and potentially exfiltrate credentials stored within the trusted session. This directly compromises the confidentiality of user credentials and can enable session hijacking. The flaw does not enable arbitrary code execution but can lead to credential theft and unauthorized actions performed under the victim’s identity.

Affected products are IBM Financial Transaction Manager for SWIFT Services for Multiplatforms. Vulnerable releases include all builds from 3.2.4.0 up to 3.2.4.15 inclusive. The vulnerability is limited to the Web UI component of these releases and does not affect other modules. No other vendors or product lines are listed as impacted.

The CVSS score of 5.4 places the issue in the moderate impact range. EPSS data is not available, and the vulnerability has not been listed in the CISA KEV catalog. The attack vector inferred from the description is unauthenticated access to the Web UI, which suggests that the vulnerability can be exploited without privileged credentials. While exploit probability cannot be quantified, the product’s recommendation to upgrade immediately signals the potential for malicious use.