CVE-2025-36352: IBM License Metric Tool XSS Vulnerability

CVE-2025-36352 Overview

CVE-2025-36352 is a stored cross-site scripting (XSS) vulnerability in IBM License Metric Tool versions 9.2.0 through 9.2.40. An authenticated user can inject arbitrary JavaScript into the Web UI, which executes in the browser context of any user who views the affected page. Successful exploitation can alter application functionality and expose credentials or session data within a trusted session.

Critical Impact
Authenticated attackers can persist malicious JavaScript in the IBM License Metric Tool Web UI, enabling credential theft and session compromise against other authenticated users, including administrators.

Affected Products

IBM License Metric Tool 9.2.0
IBM License Metric Tool 9.2.x through 9.2.40
Web UI component of IBM License Metric Tool

Discovery Timeline

2025-09-29 - CVE-2025-36352 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36352

Vulnerability Analysis

CVE-2025-36352 is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation. The IBM License Metric Tool Web UI accepts user-supplied input and stores it without sufficient output encoding or input sanitization. When another authenticated user renders the affected page, the browser interprets the stored payload as executable script.

Because the payload persists server-side, every user visiting the affected view triggers execution. This produces a wider blast radius than reflected XSS. Attackers can hijack sessions, exfiltrate authentication tokens, and issue authenticated requests on behalf of victims.

The attack requires low-privileged authentication and user interaction from the victim who loads the injected content. The scope changes because JavaScript executes in the security context of the Web UI origin, potentially crossing trust boundaries between user roles.

Root Cause

The root cause is missing or inadequate contextual output encoding when the Web UI renders user-controlled fields. Input that should be treated as inert text is instead placed into HTML or JavaScript contexts without escaping characters such as <, >, ", and '. Server-side input validation also fails to strip or reject script-bearing payloads before persistence.

Attack Vector

The attack proceeds in three stages. First, an authenticated attacker submits a crafted payload through an input field exposed by the Web UI. Second, the application stores the payload without neutralization. Third, when an administrator or another user loads the page containing the stored content, the JavaScript executes in their browser session.

The attacker's script can read cookies not marked HttpOnly, perform Document Object Model (DOM) manipulation, submit forms on behalf of the victim, or forward session identifiers to an external endpoint. This is consistent with typical stored XSS exploitation patterns and does not require novel tooling.

No public proof-of-concept exploit or exploitation in the wild has been reported for CVE-2025-36352 at the time of writing.

Detection Methods for CVE-2025-36352

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handler attributes such as onerror and onload stored in License Metric Tool database fields
Outbound HTTP requests from user browsers to unknown domains immediately after loading License Metric Tool pages
Anomalous session activity, including administrative actions originating from unusual IP addresses shortly after page loads
Web server logs showing repeated POST requests from low-privileged accounts to input-accepting endpoints

Detection Strategies

Inspect stored records in the License Metric Tool backend for HTML or JavaScript metacharacters in fields that should contain plain text
Deploy Content Security Policy (CSP) reporting to capture and log any inline script executions or blocked resource loads
Correlate authentication logs with page-render events to identify session activity that follows viewing of attacker-controlled content
Review Web Application Firewall (WAF) logs for XSS-signature matches directed at License Metric Tool endpoints

Monitoring Recommendations

Enable verbose Web UI request logging and forward logs to a centralized analytics platform for retention and correlation
Alert on privilege changes, credential resets, or license configuration modifications performed shortly after suspicious input submissions
Baseline normal input patterns per role and flag deviations that include script tags or encoded payloads
Monitor browser-side telemetry from administrator workstations for unexpected script execution on trusted internal applications

How to Mitigate CVE-2025-36352

Immediate Actions Required

Apply the fixed version referenced in the IBM Support advisory for CVE-2025-36352 as soon as change control allows
Restrict Web UI access to trusted networks and administrative bastions until patching is complete
Audit existing stored content in License Metric Tool for injected scripts and purge malicious entries
Force password rotation for any account whose session may have loaded attacker-controlled pages

Patch Information

IBM has published guidance and a remediation package on the IBM Support Page. Administrators should upgrade IBM License Metric Tool to the fixed release identified in the advisory. Verify version numbers after upgrade to confirm the patched build is running in production.

Workarounds

Limit accounts with write access to Web UI fields to the minimum set required for operational needs
Enforce a strict Content Security Policy that disallows inline scripts and untrusted external script sources
Deploy a Web Application Firewall rule set to inspect and block XSS payloads targeting License Metric Tool endpoints
Require administrators to use dedicated browser profiles or privileged access workstations when interacting with the Web UI

bash

# Example nginx reverse-proxy CSP header for the License Metric Tool Web UI
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;