CVE-2018-15528: Javasystemsolutions SSO Plugin

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

Reflected Cross-Site Scripting exists in the Java System Solutions SSO plugin 4.0.13.1 for BMC MyIT. A remote attacker can abuse this issue to inject client-side scripts into the "select_sso()" function. The payload is triggered when the victim opens a prepared /ux/jss-sso/arslogin?[XSS] link and then clicks the "Login" button.

Affected products

Published 2018-08-21. Last modified 2026-06-17.