IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 contain missing anti‑clickjacking controls that allow a remote attacker to manipulate the user interface and trigger actions without the user’s intent. This flaw can lead to unauthorized operations within the application, exposing sensitive data or influencing configuration settings. The weakness is classified as CWE‑1021, which describes interactions with HTTP headers used for clickjacking protection.

The vulnerability affects IBM App Connect Enterprise 13.0.1.0 up to and including 13.0.8.2. IBM recommends applying APAR IT49835, which is delivered in the 13.0.9.0 fix pack available via the IBM App Connect Enterprise v13‑Fix Pack Release 13.0.9.0 download page.

The CVSS score of 2.5 indicates a low severity impact, and the EPSS score is not available, suggesting limited known exploitation attempts. The vulnerability is not listed in CISA KEV. The likely attack vector involves a malicious web page embedding the vulnerable application in an iframe to trick the user into performing actions; this inference is drawn from the nature of clickjacking exploits and the absence of dynamic controls.