CVE-2018-1900: IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scrip...

Security readout for executives and security teams

IBM Curam Social Program Management has a cross-site scripting flaw that can let a user place JavaScript into the web interface. In a trusted session, that script could alter page behavior or help disclose credentials. The business concern is account compromise inside systems handling sensitive social program workflows. Exposure is likely limited to organizations running the named IBM Curam Social Program Management versions. Risk increases where the Curam web UI is reachable by many internal users, partners, or external authenticated users, especially in environments processing sensitive citizen or benefits data. Handle as a moderate-priority remediation item. It is not cited as actively exploited, but credential exposure in a trusted social-program platform can create meaningful operational and privacy risk. Accelerate if Curam is externally reachable or used by broad user populations. Mitigation focus: Review IBM advisory 10739035 for the official fix or mitigation path.; Inventory Curam Social Program Management versions across all environments.; Prioritize remediation for internet-facing or partner-facing Curam portals..

Prepared

Jun 1, 2026, 03:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.