Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information due to improper input validation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-11-07T05:18:27.843Z",
  "pubdate": "2026-11-07T05:18:27.843Z",
  "executiveSummary": "IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a Cross-Site Scripting (XSS) vulnerability caused by insufficient input validation. This security flaw enables a remote authenticated attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. The primary risk implications include the potential for unauthorized data exfiltration, session hijacking, and the manipulation of the web interface. Successful exploitation requires the attacker to possess authenticated access to the application, after which they can leverage the lack of proper input sanitization to deploy malicious scripts. The vulnerability affects the integrity and confidentiality of the administrative or user-facing interfaces, posing a significant risk to organizations relying on API Connect for management and integration tasks.",
  "technicalDetails": "The vulnerability resides in the input validation mechanisms within IBM API Connect, specifically impacting versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2. The root cause is the failure of the application to properly sanitize user-supplied data before rendering it in the browser, allowing for the injection of malicious payloads. This constitutes a classic Stored Cross-Site Scripting (XSS) vulnerability, where the malicious JavaScript is persistently stored within the application's database or state.\nThe attack flow initiates when an authenticated user—acting as the threat actor—submits specifically crafted input containing JavaScript sequences into an input field or parameter processed by the application. Because the application fails to perform adequate context-aware encoding or validation, the malicious payload is accepted and persisted by the backend system. When subsequent users, such as administrators or other authenticated personnel, access the component containing the injected script, the browser interprets the payload as legitimate code and executes it within the security context of the application's origin.\nExploitation does not require elevated administrative privileges initially, but the impact is governed by the context in which the script executes. If a high-privileged user triggers the stored script, the attacker may gain unauthorized access to administrative functions, session tokens, or sensitive configuration data. The payload behavior can range from simple redirection or defacement to complex interactions such as silent exfiltration of session cookies (facilitated by insecure cookie attributes like missing HttpOnly flags), keystroke logging, or unauthorized API calls initiated on behalf of the victim.\nThe vulnerability is exposed over the network, as the interface is accessible to authenticated users. The lack of strict output encoding or Content Security Policy (CSP) enforcement allows the injected JavaScript to bypass client-side protections. The persistence of the payload ensures that the attack remains active until the data is manually removed or purged from the backend storage. Post-exploitation impact includes full compromise of the victim's session, potential escalation of privilege if the victim holds administrative rights, and the compromise of sensitive organizational data handled by the API Connect instance."
}