IBM Guardium Data Protection 12.2 contains a CWE-79 improper neutralization of input vulnerability during web page generation. This cross-site scripting flaw enables a remote authenticated attacker to execute arbitrary code within the context of the affected application. The CVSS 3.1 base score is 8.9, reflecting network attack vector, low attack complexity, required privileges, user interaction, scope change, and high impact on confidentiality, integrity, and low impact on availability.

Successful exploitation can lead to arbitrary code execution in the context of the application, compromising confidentiality and integrity of data, and causing partial availability impact. The attacker must be authenticated and trick a user to interact with malicious input. This can result in unauthorized actions or data exposure within the Guardium Data Protection environment.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, limit access to trusted users and monitor for suspicious activity related to web interface usage.