CVE-2025-33128 Overview
CVE-2025-33128 is a stored cross-site scripting (XSS) vulnerability in IBM Engineering Workflow Management (EWM). The flaw affects versions 7.0.3 through 7.0.3 Interim Fix 020 and 7.1 through 7.1 Interim Fix 007. An authenticated user can embed arbitrary JavaScript in the Web UI, altering intended application behavior within a trusted session. Successful exploitation can lead to credential disclosure and session manipulation against other users who load the malicious content. The vulnerability is tracked under CWE-79 and requires user interaction to trigger the payload. IBM has published remediation guidance through its support portal.
Critical Impact
Authenticated attackers can inject JavaScript into the EWM Web UI, enabling credential theft and session abuse against other authenticated users.
Affected Products
- IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 020
- IBM Engineering Workflow Management 7.1 through 7.1 Interim Fix 007
- Deployments exposing the EWM Web UI to authenticated users
Discovery Timeline
- 2026-06-22 - CVE-2025-33128 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2025-33128
Vulnerability Analysis
The vulnerability resides in the IBM Engineering Workflow Management Web UI, where user-controlled input is rendered without sufficient output encoding. An authenticated user with permission to submit content into shared fields can inject JavaScript that executes in the browser of any user viewing the affected page. Because EWM is a collaborative engineering lifecycle tool, injected scripts execute within a session trusted across work items, dashboards, and related artifacts. The attack scope changes from the injecting user to the victim user, which is reflected in the scope-changed CVSS vector. Confidentiality and integrity are both impacted at a limited level, while availability is not affected.
Root Cause
The root cause is improper neutralization of input during web page generation, classified as [CWE-79]. EWM accepts input intended for display and stores or reflects it back without enforcing context-appropriate encoding for HTML, attribute, or JavaScript contexts. As a result, payloads containing <script> tags or event handlers such as onerror and onload survive the rendering pipeline and execute in the victim's browser.
Attack Vector
Exploitation requires an authenticated session and user interaction. The attacker submits a crafted payload into an EWM field rendered by the Web UI, such as a work item description, comment, or dashboard widget. When a second authenticated user navigates to the affected view, the browser parses and executes the embedded script. The script can then exfiltrate cookies, session tokens, or CSRF tokens, perform actions on behalf of the victim, or rewrite UI elements to harvest credentials. Because the script runs inside the EWM origin, same-origin protections do not block requests against the EWM API.
No verified public proof-of-concept code has been released. The vulnerability mechanism is documented in the IBM Support advisory.
Detection Methods for CVE-2025-33128
Indicators of Compromise
- Work items, comments, or dashboard fields containing <script>, javascript:, or event-handler attributes such as onerror= and onload=.
- Outbound HTTP requests from EWM user browsers to unfamiliar domains immediately after loading a work item or dashboard.
- Unexpected EWM API calls originating from legitimate user sessions, including bulk reads or permission changes.
Detection Strategies
- Review EWM database fields and audit logs for stored HTML or script syntax in user-supplied content created by accounts with write access.
- Inspect web server access logs for POST requests to EWM endpoints containing encoded script payloads (%3Cscript%3E, %6Fnerror).
- Correlate browser-based telemetry with EWM session activity to identify scripts executing outside expected page templates.
Monitoring Recommendations
- Forward EWM application logs and reverse proxy logs to a centralized SIEM and alert on payloads matching XSS signatures.
- Monitor for credential-reuse patterns, such as session tokens appearing from new IP addresses shortly after EWM page loads.
- Track upgrades and interim fix levels for IBM EWM instances to confirm patched builds are deployed across all nodes.
How to Mitigate CVE-2025-33128
Immediate Actions Required
- Apply the IBM-provided interim fix that supersedes 7.0.3 Interim Fix 020 and 7.1 Interim Fix 007 per the IBM Support advisory.
- Audit existing EWM content for stored payloads in work items, comments, wiki pages, and dashboard widgets, and remove any embedded scripts.
- Restrict EWM authoring permissions to trusted accounts until patching is complete.
Patch Information
IBM has published remediation details on its support portal. Administrators should upgrade IBM Engineering Workflow Management to a release beyond 7.0.3 Interim Fix 020 for the 7.0.3 branch or beyond 7.1 Interim Fix 007 for the 7.1 branch. Reference the IBM Support page for CVE-2025-33128 for exact fix pack identifiers and installation instructions.
Workarounds
- Enforce a strict Content Security Policy (CSP) at the reverse proxy in front of EWM to block inline script execution where supported by client browsers.
- Require step-up authentication or short session lifetimes for EWM to limit the window in which stolen tokens remain valid.
- Disable or restrict rich-text and HTML rendering features in EWM fields where business processes permit until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
