CVE-2024-41746
Published: 16 January 2025
Summary
CVE-2024-41746 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Ibm Cics Tx. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-41746 is a stored cross-site scripting vulnerability (CWE-79) in IBM CICS TX Advanced versions 10.1 and 11.1, as well as Standard 11.1. The issue affects the Web UI, enabling users to embed arbitrary JavaScript code that alters the intended functionality and can potentially lead to credentials disclosure within a trusted session. Published on 2025-01-16, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction or privileges required. Successful exploitation allows injection of malicious JavaScript into the Web UI, which executes in the context of trusted users' sessions, potentially enabling theft of credentials or other sensitive data.
IBM has issued a security advisory with details on the vulnerability and mitigation at https://www.ibm.com/support/pages/node/7171873.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38916
Vulnerability details
IBM CICS TX Advanced 10.1, 11.1, and Standard 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
more
trusted session.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public web UI directly enables remote exploitation (T1190) and facilitates browser session hijacking or web session cookie theft for credential access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents stored XSS exploitation by requiring filtering and encoding of Web UI outputs containing user-supplied data to block JavaScript execution.
Prevents injection of malicious JavaScript into the Web UI by validating and sanitizing all information inputs before storage.
Mitigates the specific stored XSS flaw in IBM CICS TX by requiring timely flaw remediation through patching as per the IBM advisory.