CVE-2019-4725: 
IBM Security Access Manager (ISAM) vulnerability analysis and mitigation

IBM Security Access Manager Appliance 9.0 was identified with a cross-site scripting (XSS) vulnerability. The vulnerability, tracked as CVE-2019-4725, was discovered and fixed in version 9.0.7.2. This security flaw allows users to embed arbitrary JavaScript code in the Web UI, potentially compromising the intended functionality of the application (IBM Security Bulletin).

The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs no privileges, but does require user interaction. The scope is changed, with low impacts on confidentiality and integrity, and no impact on availability (NVD).

The exploitation of this vulnerability could lead to credentials disclosure within a trusted session through the alteration of the Web UI's intended functionality. The attack can potentially compromise user sessions and expose sensitive information when users interact with malicious content (IBM Security Bulletin).

The vulnerability requires user interaction and is network-accessible, making it exploitable by remote attackers. The attack complexity is considered low, indicating that the vulnerability is relatively straightforward to exploit once the conditions are met (NVD).

IBM has released a security fix in IBM Security Access Manager version 9.0.7.2 (fix pack: 9.0.7-ISS-ISAM-FP0002) to address this vulnerability. No workarounds are available, and users are strongly advised to upgrade to the patched version (IBM Security Bulletin).