IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to cross‑site scripting, allowing the injection of arbitrary JavaScript into the Web UI. This could alter intended functionality and lead to credential disclosure within a trusted session, posing a risk of unauthorized access to stored credentials. The weakness corresponds to CWE‑79.

Affected vendor and product is IBM InfoSphere Information Server. Vulnerable versions range from 11.7.0.0 up to and including 11.7.1.6, and the software may be deployed on various operating systems such as AIX, Linux, and Windows as indicated by the common platform enumeration data.

The vulnerability has a CVSS base score of 5.4, indicating medium severity, and an EPSS score of less than 1%, suggesting a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector is inferred to be the web UI, requiring an adversary to have access or to trick a user into loading malicious content, potentially during an authenticated session. Although the risk is moderate, the potential for credential theft warrants timely remediation.