IBM UrbanCode Deploy (UCD) implements Cross-Origin Resource Sharing (CORS) without restricting to trusted domains, allowing an attacker to perform privileged actions and retrieve confidential information. This vulnerability is a classic example of improper domain verification in CORS requests (CWE-942, NVD-CWE-noinfo). An attacker could configure a malicious website to issue requests to UCD that the browser will forward, thereby bypassing intended security controls and potentially gaining unauthorized administrative access or leaking sensitive data.

IBM DevOps Deploy (UCD) versions 8.1 through 8.1.2.6 and 8.2 through 8.2.1.0 are affected. These include the standard builds of IBM UCD in the 8.1 and 8.2 series, and all intermediary patch releases up to the specified versions.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of <1% indicates a very low probability of exploitation in the wild. KEV not listed. The permissive CORS policy allows an attacker to host a malicious website that issues privileged requests to the UCD instance. Successful exploitation could let an attacker perform actions normally restricted to authenticated users and read sensitive configuration data. Although the risk level is moderate due to the potential impact, the very low EPSS suggests that this vulnerability is unlikely to be widely exploited, but organizations should still consider timely mitigation.