The vulnerability is a stored cross‑site scripting flaw that allows an administrative user to embed arbitrary JavaScript within the Guardium Web UI. This can alter the intended functionality of the interface and potentially lead to credential disclosure while the attacker operates within a trusted session. The weakness is an instance of improper input handling, categorized as CWE‑79.

IBM Guardium Data Protection version 12.1 running on Linux. The affected application is the web interface component that permits administrators to enter custom scripts.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. It is not listed in the CISA KEV catalog. Attackers must be authenticated as administrators and have write access to the UI configuration to inject malicious code. Once achieved, the injected script runs with the privileges of the victim session, potentially compromising credentials stored in that session.