CVE-2024-27270: 
IBM WebSphere Application Server vulnerability analysis and mitigation

IBM WebSphere Application Server Liberty versions 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting (CVE-2024-27270). This vulnerability allows attackers to embed arbitrary JavaScript code in a specially crafted URI (IBM Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) by NVD with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while IBM Corporation assigned a score of 4.7 (Medium) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

If exploited, this vulnerability could allow attackers to embed malicious JavaScript code through specially crafted URIs, potentially leading to the execution of arbitrary client-side code in the context of the vulnerable application (IBM Advisory).

The vulnerability requires user interaction and can be exploited remotely without authentication. The attack complexity is rated as High by IBM and Low by NVD, indicating some technical complexity in successful exploitation (NVD).

IBM recommends addressing the vulnerability by either applying the interim fix PH60149 or upgrading to Liberty Fix Pack 24.0.0.4 or later (targeted availability 2Q2024). The vulnerability specifically affects installations using the servlet-6.0 feature (IBM Advisory).