Description
IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Published: 2026-10-19
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Potential Credential Disclosure via Cross‑Site Scripting
Action: Patch Now
AI Analysis

Impact

IBM Concert Software versions 1.0 through 3.0.0 contain a cross‑site scripting flaw that can be triggered by an unauthenticated user through the web interface. The flaw allows malicious JavaScript to be executed in the victim's browser, changing the intended behaviour of the UI and potentially exposing credentials obtained through a trusted session. The underlying weakness maps to CWE‑79.

Affected Systems

IBM Concert 1.0, 2.x, and 3.0.0 are affected. The flaw exists in all deployments of IBM Concert prior to version 3.0.1.1, regardless of deployment type, as indicated by the vendor's advisory.

Risk and Exploitability

The baseline CVSS score is 6.1, reflecting moderate severity. EPSS score is not available, and the vulnerability is not yet listed in CISA KEV. Based on the description, the attack vector appears to be through the public web UI and does not require authentication. An attacker can embed arbitrary scripts in a page that other users, including those with valid credentials, will render, which could lead to credential theft or session hijack.

Generated by OpenCVE AI on October 19, 2026 at 18:38 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing these vulnerabilities now by upgrading to IBM Concert Software 3.0.1.1 Download IBM Concert Software 3.0.1.1 from Container software library section of IBM Entitled Registry (ICR) and follow installation instructions depending on the type of deployment.

OpenCVE Recommended Actions

  • Upgrade IBM Concert Software to version 3.0.1.1 or later.
  • If an upgrade is not immediately possible, block external access to the Concert web UI or restrict it to a trusted network segment to limit the attack surface.
  • Deploy a web application firewall or use browser‑side security controls to filter out malicious JavaScript payloads until the patch is applied.

Generated by OpenCVE AI on October 19, 2026 at 18:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel

Mon, 19 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Title IBM Concert Software Cross-Site Scripting
First Time appeared Ibm
Ibm concert
Weaknesses CWE-79
CPEs cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm concert
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Ibm Concert
Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-19T17:57:13.032Z

Reserved: 2026-03-19T02:44:08.632Z

Link: CVE-2026-4413

cve-icon Vulnrichment

Updated: 2026-10-19T17:57:08.227Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-19T18:17:07.753

Modified: 2026-11-03T15:13:36.200

Link: CVE-2026-4413

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T23:15:05Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')