Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript in the victim's browser due to cross-site scripting. User-supplied input is not properly neutralized when a web page is updated, so script content could run in another user's session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-11-07T05:18:19.730Z",
  "pubdate": "2026-11-07T05:18:19.730Z",
  "executiveSummary": "This vulnerability is identified as a Stored Cross-Site Scripting (XSS) flaw affecting IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe vulnerability originates from inadequate neutralization of user-supplied input during web page updates within the product's administrative or management interface.\nA remote authenticated attacker can leverage this flaw to inject and execute arbitrary JavaScript code within the context of a victim's browser session.\nSuccessful exploitation compromises the integrity and confidentiality of the victim's session, potentially allowing unauthorized actions or data exfiltration.\nThe vulnerability requires the attacker to be authenticated, limiting the attack surface to existing platform users, but does not necessitate high-level administrative privileges if the input field is accessible to lower-privileged accounts.\nGiven the nature of API management platforms, this risk implies that session tokens, sensitive configurations, or administrative actions could be hijacked, posing significant security risks to the overall API ecosystem managed by the compromised instance.",
  "technicalDetails": "The vulnerability is a classic Stored Cross-Site Scripting (XSS) defect occurring in IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2. The root cause is the improper sanitization and neutralization of user-provided data when the system processes updates to web page content.\nWhen a user submits input to affected fields—typically those involved in updating persistent object definitions or display labels within the API Connect dashboard—the application fails to encode or filter executable scripts. This allows malicious payloads to be stored directly in the application's backend database.\nThe attack flow proceeds as follows: First, an authenticated attacker crafts a malicious JavaScript payload. Second, the attacker injects this payload into a web form or input field that is subsequently rendered by the application to other users (e.g., administrators or developers). Third, when a legitimate user views the affected page, the server returns the stored, malicious payload as part of the HTML response. Fourth, the victim's browser, failing to differentiate between legitimate content and the injected script, executes the malicious JavaScript within the security context of the origin site.\nBecause the execution occurs within the victim's authenticated session, the malicious code inherits the victim's permissions. This allows the script to perform unauthorized actions such as modifying sensitive API configurations, stealing session cookies, or exfiltrating sensitive organizational data via asynchronous requests (AJAX) to attacker-controlled domains.\nThe scope of impact is contingent upon the permissions of the victim. If an administrative user views the injected content, the attacker could effectively gain full administrative control over the API Connect instance. Furthermore, the persistence of the payload ensures that the attack repeats every time the compromised page is accessed, creating a long-term mechanism for persistent monitoring or system manipulation.\nAs this is an authenticated vulnerability, the attacker must have a valid user account on the affected IBM API Connect platform. No specific exploit kit is required beyond standard web application manipulation tools to inject the payload during the update process. The vulnerability is network-exposed, meaning any authenticated entity with access to the management console can execute this attack."
}