CVE-2025-33110: IBM OpenPages XSS Vulnerability

CVE-2025-33110 Overview

IBM OpenPages 9.0 and 9.1 with Watson contain an HTML injection vulnerability that allows an authenticated remote attacker to inject malicious HTML into the application. When a victim views the injected content, the browser renders it within the security context of the OpenPages site.

The flaw is tracked as CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page. Attackers can leverage it to alter page content, stage phishing, or facilitate follow-on attacks against authenticated users of the governance, risk, and compliance (GRC) platform.

Critical Impact
A low-privileged attacker can inject HTML that executes in another user's browser session, enabling content spoofing, credential harvesting, and cross-user data exposure within the OpenPages application.

Affected Products

IBM OpenPages with Watson 9.0
IBM OpenPages with Watson 9.1
Deployments exposing the OpenPages web interface to authenticated users

Discovery Timeline

2025-11-06 - CVE-2025-33110 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-33110

Vulnerability Analysis

IBM OpenPages is a governance, risk, and compliance platform used to manage operational risk, regulatory compliance, and audit workflows. The affected versions fail to properly neutralize HTML tags submitted through user-controllable input fields before rendering them back in web pages.

Because the injected markup executes within the origin of the OpenPages host, attackers can render arbitrary layout elements, redirect users, or embed content that mimics legitimate application controls. The scope-change indication in the vulnerability metrics reflects that injected content can affect resources beyond the attacker's own account.

Exploitation requires an authenticated session and victim interaction, such as opening a shared record, dashboard, or comment that contains the injected payload.

Root Cause

The root cause is missing or incomplete output encoding of user-supplied input in one or more OpenPages web components. Fields intended to store plain text are rendered without contextual HTML escaping, allowing tags such as <img>, <iframe>, or <style> to be interpreted by the browser instead of displayed as literal text.

Attack Vector

The vulnerability is exploited over the network through the OpenPages web interface. An authenticated attacker submits a crafted payload into a field that another user later views, for example an object description, comment, or attachment metadata.

A typical exploitation flow involves the attacker inserting HTML markup such as a fake login form, malicious hyperlink, or externally sourced script tag into an OpenPages record. When a colleague or auditor opens that record, the browser renders the injected markup within the OpenPages origin, enabling content spoofing or theft of session-bound data.

No verified proof-of-concept code has been published. Refer to the IBM Support advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-33110

Indicators of Compromise

OpenPages records containing unexpected HTML tags such as <script>, <iframe>, <object>, or <style> in fields designed for plain text
Web server logs showing POST or PUT requests to OpenPages APIs with URL-encoded HTML markup in parameter values
User reports of unexpected page layouts, redirects, or authentication prompts inside OpenPages
Outbound browser connections from OpenPages users to unfamiliar domains referenced from injected src or href attributes

Detection Strategies

Inspect OpenPages database fields and audit tables for stored payloads containing HTML control characters (<, >, &#) that would not appear in legitimate GRC content
Deploy web application firewall (WAF) rules that flag HTML tag patterns in requests targeting OpenPages endpoints
Correlate authenticated OpenPages user activity with anomalous outbound DNS or HTTP requests from the same client sessions

Monitoring Recommendations

Enable verbose HTTP request logging on the OpenPages application tier and forward logs to a centralized analytics platform
Alert on repeated write operations from a single account containing markup characters in narrative or description fields
Review OpenPages change history reports on a scheduled basis for content modifications that include HTML elements

How to Mitigate CVE-2025-33110

Immediate Actions Required

Apply the IBM security update referenced in the IBM Support advisory for CVE-2025-33110
Inventory all OpenPages 9.0 and 9.1 deployments, including test and disaster-recovery environments
Audit user accounts and reduce privileges for users who do not require write access to shared records
Review recent record modifications for embedded HTML payloads and sanitize affected fields

Patch Information

IBM has published remediation guidance for OpenPages 9.0 and 9.1 with Watson through its support portal. Administrators should review the IBM Support page for fix pack availability, supported upgrade paths, and post-installation validation steps.

Workarounds

Restrict OpenPages access to trusted internal networks or VPN users where feasible until the patch is applied
Configure a Content Security Policy (CSP) at the reverse proxy layer to block inline scripts and unauthorized external resource loads
Provide user awareness guidance about links or embedded content that appears inside OpenPages records
Enforce least-privilege role assignments so fewer users can populate fields consumed by wide audiences

bash

# Example NGINX reverse proxy header hardening for the OpenPages front end
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; frame-ancestors 'self'; object-src 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;