XSS in IBM watsonx.ai Web UI (CVE-2024-49785)
Date: 2024
Affected: IBM watsonx.ai 1.1-2.0.3
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium

IBM watsonx.ai 1.1-2.0.3 and on Cloud Pak for Data 4.8-5.0.3 allows authenticated XSS in the Web UI, potentially leading to credential disclosure within a trusted session.


Mitigations:

Architectural layers (MAESTRO):