CVE-2025-36000: IBM WebSphere Application Server XSS Flaw

CVE-2025-36000 Overview

CVE-2025-36000 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in IBM WebSphere Application Server Liberty versions 17.0.0.3 through 25.0.0.8. A privileged user can embed arbitrary JavaScript code in the Web UI, altering intended functionality within a trusted session. Successful exploitation can lead to credential disclosure and session compromise for other administrators interacting with the affected interface.

Critical Impact

A privileged attacker can inject persistent JavaScript into the WebSphere Liberty Web UI, hijacking trusted administrator sessions and exposing credentials transmitted through the console.

Affected Products

• IBM WebSphere Application Server Liberty 17.0.0.3
• IBM WebSphere Application Server Liberty versions through 25.0.0.8
• Liberty profile deployments exposing the administrative Web UI

Discovery Timeline

• 2025-08-12 - CVE-2025-36000 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36000

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Web UI of IBM WebSphere Application Server Liberty. Input supplied by a privileged user is persisted by the server and later rendered in the administrative interface without sufficient output encoding. When another user loads the affected view, the browser executes the injected JavaScript in the context of the Liberty Web UI origin.

Because the payload executes within an authenticated administrative session, an attacker can access session tokens, form data, and any credentials entered into the console. The scope change reflected in the CVSS vector indicates that the payload can affect resources beyond the initially vulnerable component, extending impact across trusted browser contexts.

Exploitation requires high privileges and user interaction, which limits opportunistic attacks. It remains relevant in multi-tenant or delegated-administration environments where lower-trust administrators interact with the same console as higher-privileged operators.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The Liberty Web UI stores user-controlled values and later reflects them into HTML responses without applying context-aware output encoding, allowing JavaScript to execute in the DOM of consuming users.

Attack Vector

The attack vector is network-based through the Liberty administrative Web UI. A privileged attacker submits crafted input containing JavaScript into a persistent field. When another authenticated user views the affected page, the browser parses and executes the stored script, enabling credential theft, session manipulation, or unauthorized administrative actions.

No verified public proof-of-concept code is available for this vulnerability. Refer to the IBM Support Article for vendor-provided technical details.

Detection Methods for CVE-2025-36000

Indicators of Compromise

• Unexpected <script> tags, event handlers such as onerror= or onload=, or javascript: URIs stored in Liberty configuration fields, labels, or descriptions rendered by the Web UI.
• Web UI responses containing HTML or JavaScript fragments in fields that should hold plain text values.
• Anomalous outbound requests from administrator browsers to unfamiliar domains shortly after loading Liberty console pages.

Detection Strategies

• Review Liberty audit logs for administrative changes made by privileged accounts that include HTML markup or script syntax in submitted values.
• Inspect stored configuration and metadata for encoded payloads such as <script>, %3Cscript%3E, or Base64-wrapped JavaScript.
• Correlate Web UI access with browser telemetry to identify script execution originating from administrator console sessions.

Monitoring Recommendations

• Enable and forward Liberty access and audit logs to a centralized analytics platform for query and retention.
• Monitor administrative account activity for unusual field edits, especially by delegated or lower-trust admin roles.
• Alert on Content Security Policy (CSP) violation reports generated by browsers loading the Liberty Web UI.

How to Mitigate CVE-2025-36000

Immediate Actions Required

• Apply the fix referenced in the IBM Support Article to all Liberty instances running versions 17.0.0.3 through 25.0.0.8.
• Restrict access to the Liberty administrative Web UI to trusted networks and a minimal set of administrators.
• Audit existing stored configuration values for injected scripts and remove any malicious content.

Patch Information

IBM has published remediation guidance in the IBM Support Article for CVE-2025-36000. Administrators should upgrade WebSphere Application Server Liberty to the fixed release identified by IBM and validate that the Web UI applies proper output encoding after the update.

Workarounds

• Limit administrative role assignments so that only fully trusted operators can write to fields rendered by the Web UI.
• Access the Liberty console from a hardened, dedicated administrative workstation with browser isolation where feasible.
• Deploy a Content Security Policy at the reverse proxy in front of Liberty to restrict inline script execution until the patch is applied.

# Example reverse-proxy CSP header restricting inline scripts in front of Liberty Web UI
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;