Security readout for executives and security teams
Plain-English summary
IBM Cloud Pak for Applications 4.3 has a web interface flaw that can let an authenticated user place JavaScript into the UI. If another trusted session renders it, the script could alter page behavior and potentially expose credentials.
Executive priority
Treat as a moderate-priority application security issue. It is not shown as actively exploited, but it affects trusted sessions and could expose credentials in administrative contexts.
Technical view
CVE-2021-20365 is a cross-site scripting vulnerability in IBM Cloud Pak for Applications 4.3. The CVSS 3.0 score is 5.4 with network attack vector, low privileges required, user interaction required, changed scope, and low confidentiality and integrity impact.
Likely exposure
Exposure is limited to organizations running IBM Cloud Pak for Applications version 4.3, especially where the Web UI is accessible to many authenticated users or administrators.
Exploitation context
The bundle does not show CISA KEV listing or confirmed active exploitation. IBM X-Force scoring marks exploit maturity high, but the CVSS vector still requires low privileges and user interaction.
Researcher notes
Evidence supports XSS in the Web UI with PR:L and UI:R. The source bundle does not provide a CWE, affected CPEs, exploit details, or exact fixed version, so remediation should follow IBM guidance.
Mitigation direction
- Check IBM advisory 6471345 for the official remediation path.
- Apply IBM-provided fixes or upgrade guidance for affected 4.3 deployments.
- Limit Web UI access to trusted users until remediation is complete.
- Review session and credential-handling controls around administrative UI use.
Validation and detection
- Inventory Cloud Pak for Applications deployments and confirm exact version 4.3 presence.
- Confirm whether IBM advisory 6471345 applies to each deployment.
- Review logs for unusual Web UI activity or unexpected script-related errors.
- Verify remediation status through approved vulnerability scanning or vendor-supported checks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-20365 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/UI:R/PR:L/I:L/AC:L/A:N/S:C/C:L/AV:N/RL:O/RC:C/E:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/UI:R/PR:L/I:L/AC:L/A:N/S:C/C:L/AV:N/RL:O/RC:C/E:H2.32.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
5.4MediumVector: CVSS:3.0/UI:R/PR:L/I:L/AC:L/A:N/S:C/C:L/AV:N/RL:O/RC:C/E:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ibm.com/support/pages/node/6471345CVE reference · x_refsource_CONFIRM
- ibm-cpa-cve202120365-xss (195036)CVE reference · vdb-entry, x_refsource_XF
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.