CVE-2025-36172
Full vulnerability record from the local CVENow database.
Description
IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 001, 24.0.1 through 24.0.1 Interim Fix 004, 24.0.0 through 24.0.0 Interim Fix 006, and earlier unsupported releases IBM Business Automation Workflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Severity
MEDIUM
CVSS score
5.4
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2025-11-03 22:18:51.097000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-36172",
"sourceIdentifier": "[email protected]",
"published": "2025-11-03T22:18:51.097",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 001, 24.0.1 through 24.0.1 Interim Fix 004, 24.0.0 through 24.0.0 Interim Fix 006, and earlier unsupported releases IBM Business Automation Workflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
},
{
"lang": "es",
"value": "IBM Cloud Pak for Business Automation 25.0.0 hasta 25.0.0 Corrección Provisional 001, 24.0.1 hasta 24.0.1 Corrección Provisional 004, 24.0.0 hasta 24.0.0 Corrección Provisional 006, y versiones sin soporte anteriores de IBM Business Automation Workflow es vulnerable a cross-site scripting almacenado. Esta vulnerabilidad permite a un usuario autenticado incrustar código JavaScript arbitrario en la interfaz de usuario web, alterando así la funcionalidad prevista y potencialmente llevando a la divulgación de credenciales dentro de una sesión de confianza."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "IBM",
"product": "Cloud Pak for Business Automation",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:interim_fix_004:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_006:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:25.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_business_automation:25.0.0:interim_fix_001:*:*:*:*:*:*"
],
"versions": [
{
"version": "25.0.0",
"lessThanOrEqual": "25.0.0 Interim Fix 001",
"versionType": "semver",
"status": "affected"
},
{
"version": "24.0.1",
"lessThanOrEqual": "24.0.1 Interim Fix 004",
"versionType": "semver",
"status": "affected"
},
{
"version": "24.0.0",
"lessThanOrEqual": "24.0.0 Interim Fix 006",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-11-03T21:41:35.325568Z",
"id": "CVE-2025-36172",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "EF879B84-21B0-4FD4-AD2E-7F29EBDD218A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "496D1A48-3403-471F-AD07-AEC7E5000AD8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "AA215EC3-DDFE-494D-862C-35CA30D9BEDE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_003:*:*:*:*:*:*",
"matchCriteriaId": "969ED94C-DB65-482F-B8B8-251B56DE264D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "D1810412-5987-4F53-A81E-096A4F0187B5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_005:*:*:*:*:*:*",
"matchCriteriaId": "9CC01202-3D62-4544-BE9C-47300063896E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_006:*:*:*:*:*:*",
"matchCriteriaId": "23966701-9B59-4CF9-9425-2C029318BF5C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "F68528C5-034B-4B2C-8745-B969B14B52C5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "EADE80E3-4E60-4154-A559-93E2325D799A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:interim_fix_002:*:*:*:*:*:*",
"matchCriteriaId": "D01FC35C-29F1-4D57-8804-07A5C1E9EA85"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:interim_fix_004:*:*:*:*:*:*",
"matchCriteriaId": "4D682E4B-DA22-4F88-A38F-76FF080AE0B5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:25.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "70431A72-663D-432E-9D94-5BBE380E06AB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:25.0.0:interim_fix_001:*:*:*:*:*:*",
"matchCriteriaId": "33128B64-7030-4A4E-8EF2-E285AF44F99F"
}
]
}
]
}
],
"references": [
{
"url": "https://www.ibm.com/support/pages/node/7250047",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}