CVE-2024-49349 in Financial Transaction Manager for SWIFT Services for Multiplatforms
Summary
by MITRE • 01/31/2025
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.1 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/14/2025
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms contains a stored cross-site scripting vulnerability that affects versions 3.2.4.0 through 3.2.4.1. This vulnerability resides in the web user interface component where user-supplied input is not properly sanitized before being rendered back to users. The flaw allows authenticated attackers to inject malicious javascript code into the application's web interface which persists in the system and executes whenever other users view the affected content. This type of vulnerability falls under CWE-79 which specifically addresses cross-site scripting flaws where input is not properly validated or escaped. The security implications are particularly severe given that this is a financial transaction management system that handles sensitive SWIFT financial messaging protocols. Attackers could leverage this vulnerability to steal session cookies, credentials, or other sensitive information from authenticated users who interact with the compromised interface elements. The attack vector requires authentication since only authenticated users can inject content, but once successful, the malicious code executes in the context of other users' sessions. This creates a significant risk of credential theft and session hijacking within trusted financial environments where users maintain persistent authenticated sessions. The vulnerability aligns with ATT&CK technique T1531 which covers "Modify Application Configuration" and T1071.004 which involves application layer protocol manipulation. Organizations using this software should immediately implement input validation and output encoding controls to prevent malicious script injection. Additionally, regular security assessments and monitoring of user-generated content should be enhanced to detect potential exploitation attempts. The remediation approach should focus on implementing proper sanitization of all user inputs before storage and rendering, along with regular security updates from IBM to address this specific vulnerability. Given the financial nature of the system and the potential for sensitive data exposure, organizations should also consider implementing additional monitoring and detection mechanisms specifically targeting cross-site scripting attempts within their financial transaction processing environments. This vulnerability demonstrates the critical importance of securing web interfaces in financial applications where persistent authenticated sessions can be exploited to gain unauthorized access to sensitive transactional data and system resources.