Skip to content
OpenAdvisories
Medium · 5.4 CVE-2025-36033 EUVD-2025-206814GHSA-mrxh-c37v-gc5w

IBM Engineering Lifecycle Management - Global Configuration Management is vulnerable to cross-site scripting

Published Feb 3, 2026 · Updated Feb 4, 2026 · Assigned by ibm

Vendor: IBM Product: Engineering Lifecycle Management - Global Configuration Management

Description

IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 through 7.1.0 Interim Fix 004 IBM Global Configuration Management is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected products

VendorProductAffectedFixed
IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 – ≤ 7.0.3 Interim Fix 017, 7.1.0 – ≤ 7.1.0 Interim Fix 004 —

References