The flaw in migration‑planner allows an authenticated attacker to store a malicious javascript: URL in the AgentStatusUpdate.CredentialUrl field. When a victim later views this field in the Hybrid Cloud Console, the browser will execute the JavaScript in the victim’s session, enabling the attacker to run arbitrary code, steal cookies, or modify page content. The weakness is a classic web‑application injection flaw as identified by CWE‑79.

The vulnerability affects the migration‑planner application. No specific vendor or product version information was supplied in the advisory; administrators should check the product installation for any exposed AgentStatusUpdate features.

The CVSS score is 6.3, indicating a moderate severity with unauthenticated impact limited to the victim’s session. EPSS is not available, so the likelihood of exploitation cannot be quantified, but the flaw is exploitable by any authenticated user with write access to AgentStatusUpdate. The vulnerability is not listed in the CISA KEV catalog, but it remains a potential risk for environments where the Console is accessed by multiple users.