Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link.
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS Score: 4.8
The attack is remote and authenticated, and another user must actively open a crafted link.
| Exploitability Metrics |
Vulnerable System Impact Metrics |
Subsequent System Impact Metrics |
| Attack Vector |
Network |
Confidentiality |
None |
Confidentiality |
Low |
| Attack Complexity |
Low |
Integrity |
None |
Integrity |
Low |
| Attack Requirements |
None |
Availability |
None |
Availability |
None |
| Privileges Required |
Low |
| User Interaction |
Active |
The attack is remote and authenticated, and another user must actively open a crafted link.
CVSS 4.0
No fixed version has been confirmed.