IBM Content Navigator versions 3.0.15, 3.1.0, and 3.2.0 contain a cross‑site scripting flaw that lets an authenticated user embed arbitrary JavaScript into the web interface. This can alter the intended functionality and, because the code executes with the privileges of the logged‑in user, may lead to disclosure of credentials or other sensitive information. The flaw is catalogued as CWE‑79.

The affected product is IBM Content Navigator. Vulnerable releases are 3.0.15, 3.1.0, and 3.2.0. No other version information is listed.

The CVSS score is 5.4, indicative of moderate severity, and the EPSS score is below 1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated user with access to the application; the attack vector therefore is limited to authenticated session abuse and not to unauthenticated remote exploitation.