CVE-2025-36172: cloud pak for business automation 24.0.0, 24.0.1, 25.0.0; +1 more affected products

Affected technology

cloud pak for business automation · 24.0.0
ibm

cloud pak for business automation · 24.0.0 · update interim_fix_001
ibm

cloud pak for business automation · 24.0.0 · update interim_fix_002
ibm

cloud pak for business automation · 24.0.0 · update interim_fix_003
ibm

cloud pak for business automation · 24.0.0 · update interim_fix_004
ibm

cloud pak for business automation · 24.0.0 · update interim_fix_005
ibm

cloud pak for business automation · 24.0.0 · update interim_fix_006
ibm

cloud pak for business automation · 24.0.1
ibm

cloud pak for business automation · 24.0.1 · update interim_fix_001
ibm

cloud pak for business automation · 24.0.1 · update interim_fix_002
ibm

cloud pak for business automation · 24.0.1 · update interim_fix_004
ibm

cloud pak for business automation · 25.0.0
ibm

cloud pak for business automation · 25.0.0 · update interim_fix_001
ibm

Cloud Pak for Business Automation · 25.0.0 through 25.0.0 Interim Fix 001, 24.0.1 through 24.0.1 Interim Fix 004, 24.0.0 through 24.0.0 Interim Fix 006
IBM

Description’s affected range: through 25.0.0 Interim Fix 001

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

An authenticated user can embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Vendor/CNA’s CVSS 3.1 assessment (base score 6.4/10) rates confidentiality and integrity impact as low; availability impact as none. NVD’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none.