The vulnerability is a classic cross‑site scripting flaw (CWE‑79) that occurs when user input is rendered in the IBM WebSphere Application Server administrative console without proper encoding. An attacker who can supply crafted input could cause the admin console to execute JavaScript in the victim’s browser, potentially leading to session hijacking, credential theft, or further lateral movement within the system. While the flaw does not directly allow arbitrary code execution on the host, the impact depends strongly on the privileges of the affected administrative user and the protective controls in place.

The affected products are IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server versions 8.5 and 9.0. The security bulletin notes that all three releases ship the vulnerable code in the administrative console and that IBM has released official fixes for each impacted version.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of 0.00162 (0.162%) indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, so publicly demonstrated exploits are not known. However, any attacker who can reach the administrative console—whether by compromise of credentials or by exploiting an exposed management interface—could inject malicious script. The risk is therefore elevated for environments where the console is reachable from untrusted networks or where privileged accounts are not robustly protected.