Cross-site scripting in IBM Engineering Workflow Management
Priority LOW 24CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00231 14th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | Engineering Workflow Management | 7.0.3 – 7.0.3 Interim Fix 020; 7.1.0 – 7.1 Interim Fix 007 | — | No fix listed | CNA |
- Engineering Workflow Management VendorIBM Affected 7.0.3 – 7.0.3 Interim Fix 020; 7.1.0 – 7.1 Interim Fix 007 Fixed in — No fix listed CNA
CPE configurations NVD · 29
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:-:*:*:*:*:*:* | 7.0.3 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix001:*:*:*:*:*:* | 7.0.3 ifix001 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix002:*:*:*:*:*:* | 7.0.3 ifix002 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix003:*:*:*:*:*:* | 7.0.3 ifix003 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix004:*:*:*:*:*:* | 7.0.3 ifix004 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix005:*:*:*:*:*:* | 7.0.3 ifix005 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix006:*:*:*:*:*:* | 7.0.3 ifix006 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix007:*:*:*:*:*:* | 7.0.3 ifix007 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix008:*:*:*:*:*:* | 7.0.3 ifix008 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix009:*:*:*:*:*:* | 7.0.3 ifix009 | Vulnerable | IBM |
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:-:*:*:*:*:*:* Versions 7.0.3 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix001:*:*:*:*:*:* Versions 7.0.3 ifix001 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix002:*:*:*:*:*:* Versions 7.0.3 ifix002 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix003:*:*:*:*:*:* Versions 7.0.3 ifix003 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix004:*:*:*:*:*:* Versions 7.0.3 ifix004 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix005:*:*:*:*:*:* Versions 7.0.3 ifix005 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix006:*:*:*:*:*:* Versions 7.0.3 ifix006 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix007:*:*:*:*:*:* Versions 7.0.3 ifix007 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix008:*:*:*:*:*:* Versions 7.0.3 ifix008 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix009:*:*:*:*:*:* Versions 7.0.3 ifix009 Vulnerable ·IBM
Show 19 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix010:*:*:*:*:*:* | 7.0.3 ifix010 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix011:*:*:*:*:*:* | 7.0.3 ifix011 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix012:*:*:*:*:*:* | 7.0.3 ifix012 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix013:*:*:*:*:*:* | 7.0.3 ifix013 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix014:*:*:*:*:*:* | 7.0.3 ifix014 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix015:*:*:*:*:*:* | 7.0.3 ifix015 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix016:*:*:*:*:*:* | 7.0.3 ifix016 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix017:*:*:*:*:*:* | 7.0.3 ifix017 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix018:*:*:*:*:*:* | 7.0.3 ifix018 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix019:*:*:*:*:*:* | 7.0.3 ifix019 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix020:*:*:*:*:*:* | 7.0.3 ifix020 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:-:*:*:*:*:*:* | 7.1.0 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix001:*:*:*:*:*:* | 7.1.0 ifix001 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix002:*:*:*:*:*:* | 7.1.0 ifix002 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix003:*:*:*:*:*:* | 7.1.0 ifix003 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix004:*:*:*:*:*:* | 7.1.0 ifix004 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix005:*:*:*:*:*:* | 7.1.0 ifix005 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix006:*:*:*:*:*:* | 7.1.0 ifix006 | Vulnerable | IBM |
| cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix007:*:*:*:*:*:* | 7.1.0 ifix007 | Vulnerable | IBM |
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix010:*:*:*:*:*:* Versions 7.0.3 ifix010 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix011:*:*:*:*:*:* Versions 7.0.3 ifix011 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix012:*:*:*:*:*:* Versions 7.0.3 ifix012 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix013:*:*:*:*:*:* Versions 7.0.3 ifix013 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix014:*:*:*:*:*:* Versions 7.0.3 ifix014 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix015:*:*:*:*:*:* Versions 7.0.3 ifix015 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix016:*:*:*:*:*:* Versions 7.0.3 ifix016 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix017:*:*:*:*:*:* Versions 7.0.3 ifix017 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix018:*:*:*:*:*:* Versions 7.0.3 ifix018 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix019:*:*:*:*:*:* Versions 7.0.3 ifix019 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix020:*:*:*:*:*:* Versions 7.0.3 ifix020 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:-:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix001:*:*:*:*:*:* Versions 7.1.0 ifix001 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix002:*:*:*:*:*:* Versions 7.1.0 ifix002 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix003:*:*:*:*:*:* Versions 7.1.0 ifix003 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix004:*:*:*:*:*:* Versions 7.1.0 ifix004 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix005:*:*:*:*:*:* Versions 7.1.0 ifix005 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix006:*:*:*:*:*:* Versions 7.1.0 ifix006 Vulnerable ·IBM
- cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix007:*:*:*:*:*:* Versions 7.1.0 ifix007 Vulnerable ·IBM
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-33128
- 2026-10-03 Alias added: GHSA-qx9x-w8gf-h8rf
References
More IBM Engineering Workflow Management vulnerabilities
- TI-2021-10504 Server-side request forgery in IBM Engineering Workflow Management CVSS 3.1HIGH 8.8
- TI-2021-10449 IBM Jazz Team Server products could allow an authenticated user to obtain elevated… CVSS 3.1HIGH 7.5
- TI-2024-34381 IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by… CVSS 3.1MEDIUM 6.5
- TI-2021-03752 XML external entity injection in IBM Engineering Lifecycle Optimization CVSS 3.1HIGH 7.1
- TI-2020-04175 Broken or risky cryptographic algorithm in IBM Rational DOORS Next Generation CVSS 3.1HIGH 7.5
- TI-2021-10458 Cleartext storage of sensitive information in IBM Engineering Lifecycle Optimization CVSS 3.1MEDIUM 6.5
Sources
- CVE-2025-33128 · CVE Program
- CVE-2025-33128 · NVD
- FIRST EPSS
- GHSA-qx9x-w8gf-h8rf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences