← Back

CVE-2025-36172

nvd nist
Published: Nov 3, 2025Modified: Jun 17, 2026

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.3 / Impact: 2.7
Source: NVD

Description

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 001, 24.0.1 through 24.0.1 Interim Fix 004, 24.0.0 through 24.0.0 Interim Fix 006, and earlier unsupported releases IBM Business Automation Workflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected (13)

Ibm
1 product
Cloud Pak For Business Automation
Configuration A
13 vulnerable
Vulnerable SoftwareAffected Versions
Ibm
Cloud Pak For Business Automation
Version 24.0.0
Cloud Pak For Business Automation
Version 24.0.0 interim_fix_001
Cloud Pak For Business Automation
Version 24.0.0 interim_fix_002
Cloud Pak For Business Automation
Version 24.0.0 interim_fix_003
Cloud Pak For Business Automation
Version 24.0.0 interim_fix_004
Cloud Pak For Business Automation
Version 24.0.0 interim_fix_005
Cloud Pak For Business Automation
Version 24.0.0 interim_fix_006
Cloud Pak For Business Automation
Version 24.0.1
Cloud Pak For Business Automation
Version 24.0.1 interim_fix_001
Cloud Pak For Business Automation
Version 24.0.1 interim_fix_002
Cloud Pak For Business Automation
Version 24.0.1 interim_fix_004
Cloud Pak For Business Automation
Version 25.0.0
Cloud Pak For Business Automation
Version 25.0.0 interim_fix_001

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

Source: psirt@us.ibm.com
Vendor Advisory

Timeline

No history available yet.