CVE-2025-36054: business automation workflow 24.0.0, 24.0.1, 25.0.0; +3 more affected products

Affected technology

business automation workflow · Version not applicable in the source CPE
ibm

business automation workflow · 24.0.0
ibm

business automation workflow · 24.0.0 · update if001
ibm

business automation workflow · 24.0.0 · update if002
ibm

business automation workflow · 24.0.0 · update if003
ibm

business automation workflow · 24.0.0 · update if004
ibm

business automation workflow · 24.0.0 · update if005
ibm

business automation workflow · 24.0.0 · update if006
ibm

business automation workflow · 24.0.1
ibm

business automation workflow · 24.0.1 · update if001
ibm

business automation workflow · 24.0.1 · update if002
ibm

business automation workflow · 24.0.1 · update if004
ibm

business automation workflow · 25.0.0
ibm

business automation workflow · 25.0.0 · update if001
ibm

process federation server · 24.0.0
ibm

process federation server · 24.0.1
ibm

process federation server · 25.0.0
ibm

Business Automation Workflow containers · 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through 25.0.0-IF001
IBM

Business Automation Workflow traditional with Process Federation Server · 24.0.0 through 24.0.1, 25.0.0
IBM

Description’s affected range: through 24.0.0-IF006

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Vendor/CNA’s CVSS 3.1 assessment (base score 6.1/10) rates confidentiality and integrity impact as low; availability impact as none.