IBM App Connect Enterprise versions 12.0.x and 13.0.x contain an HTML injection flaw in the handling of error messages. The flaw allows a remote attacker to embed arbitrary markup through the web user interface or Administration REST API, leading to content spoofing. Because the vulnerability stems from improper output encoding (CWE-79), an attacker could alter the appearance of error responses, potentially deceiving users into accepting forged content. The flaw does not provide code execution or privilege escalation, but it may facilitate phishing or social‑engineering attacks that exploit users’ trust.

The vulnerability impacts IBM App Connect Enterprise for both version 12.0.1.0 through 12.0.12.30 and version 13.0.1.0 through 13.0.8.2. Administrators should verify if their deployments fall within these ranges and apply the appropriate fix as described by IBM.

With a CVSS base score of 4.2 the flaw is considered low to moderate severity. The EPSS score is currently unavailable, indicating that the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The attack can be carried out remotely via the exposed web interface or REST API. An attacker merely needs to send crafted requests that trigger error responses containing malicious HTML; no privileged or local access is required. The sole impact is the ability to spoof content presented to users.