IBM Financial Transaction Manager for SWIFT Services Stored XSS Vulnerability (CVE-2025-36148)

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms Cross-Site Scripting Vulnerability Vulnerability Overview CVEID: CVE-2025-36148 Description: IBM Financial Transaction Manager for SWIFT Services contains a cross-site scripting vulnerability. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, potentially leading to the tampering of expected functionality within a trusted session, which could result in credential disclosure. CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVSS Source: IBM CVSS Base Score: 5.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Affected Scope Affected Product: IBM Financial Transaction Manager for SWIFT Services for Multiplatforms Affected Versions: 3.2.4.0 - 3.2.4.15 Remediation Remediation Recommendation: IBM strongly recommends addressing this vulnerability immediately by upgrading to Fix Pack 16. Fixed Versions: 3.2.4.0 - 3.2.4.15 Remediation Instructions: Install IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 Fix Pack 16. References Complete CVSS v3 Guide On-line Calculator v3 Related Resources IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard" designed to convey vulnerability severity and help determine the urgency and priority of response. IBM provides the CVSS score "as is" without warranty of any kind, express or implied, including but not limited to the implied warranties of merchantability and fitness for a particular purpose. Customers are responsible for assessing the impact of vulnerabilities on their environment. IBM regularly updates the records of components within its product portfolio to address potential vulnerabilities. As part of this effort, IBM identifies previously unrecognized packages and addresses associated vulnerabilities in the product/service inventory, regardless of the CVE date. The inclusion of an older CVEID does not indicate that the referenced product has been used by IBM since that date, nor that IBM was aware of the vulnerability prior to that date. The "affected products and versions" referenced are intended to include only IBM-supported and non-expired products and versions. Therefore, unsupported or extended support products and versions not referenced in this security bulletin do not constitute a determination by IBM that they are unaffected by the vulnerability. The referencing of one or more unsupported versions in this security bulletin does not impose an obligation on IBM to remediate any unsupported or extended support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Financial Transaction Manager for SWIFT Services Stored XSS Vulnerability (CVE-2025-36148)