This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Ivanti Neurons for ITSM (On-Premise) prior to version 2025.4. An authenticated attacker can store malicious scripts that execute in the context of other users' sessions, potentially leaking limited session information. The attack requires the victim to interact with the malicious content. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, scope changed, and limited confidentiality and integrity impact without availability impact.

An authenticated remote attacker can exploit this stored XSS vulnerability to obtain limited information from other user sessions, potentially leading to partial compromise of user data confidentiality and integrity. There is no indication of availability impact. The vulnerability requires user interaction, limiting the attack scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure by restricting authenticated user privileges and educating users about the risks of interacting with untrusted content within the application.