CVE-2025-33128: engineering workflow management 7.0.3, 7.1.0; +1 more affected products

Affected technology

engineering workflow management · 7.0.3
ibm

engineering workflow management · 7.0.3 · update ifix001
ibm

engineering workflow management · 7.0.3 · update ifix002
ibm

engineering workflow management · 7.0.3 · update ifix003
ibm

engineering workflow management · 7.0.3 · update ifix004
ibm

engineering workflow management · 7.0.3 · update ifix005
ibm

engineering workflow management · 7.0.3 · update ifix006
ibm

engineering workflow management · 7.0.3 · update ifix007
ibm

engineering workflow management · 7.0.3 · update ifix008
ibm

engineering workflow management · 7.0.3 · update ifix009
ibm

engineering workflow management · 7.0.3 · update ifix010
ibm

engineering workflow management · 7.0.3 · update ifix011
ibm

engineering workflow management · 7.0.3 · update ifix012
ibm

engineering workflow management · 7.0.3 · update ifix013
ibm

engineering workflow management · 7.0.3 · update ifix014
ibm

engineering workflow management · 7.0.3 · update ifix015
ibm

engineering workflow management · 7.0.3 · update ifix016
ibm

engineering workflow management · 7.0.3 · update ifix017
ibm

engineering workflow management · 7.0.3 · update ifix018
ibm

engineering workflow management · 7.0.3 · update ifix019
ibm

engineering workflow management · 7.0.3 · update ifix020
ibm

engineering workflow management · 7.1.0
ibm

engineering workflow management · 7.1.0 · update ifix001
ibm

engineering workflow management · 7.1.0 · update ifix002
ibm

engineering workflow management · 7.1.0 · update ifix003
ibm

engineering workflow management · 7.1.0 · update ifix004
ibm

engineering workflow management · 7.1.0 · update ifix005
ibm

engineering workflow management · 7.1.0 · update ifix006
ibm

engineering workflow management · 7.1.0 · update ifix007
ibm

Engineering Workflow Management · 7.0.3 through 7.0.3 Interim Fix 020, 7.1.0 through 7.1 Interim Fix 007
IBM

Description’s affected range: through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

An authenticated user can embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Vendor/CNA’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none.