CVE-2025-36172

published 2025-11-03

CVE-2025-36172: IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 001, 24.0.1 through 24.0.1 Interim Fix 004, 24.0.0 through 24.0.0 Interim Fix 006, and…

medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 001, 24.0.1 through 24.0.1 Interim Fix 004, 24.0.0 through 24.0.0 Interim Fix 006, and earlier unsupported releases IBM Business Automation Workflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
ibm	cloud_pak_for_business_automation	—	—
ibm	cloud_pak_for_business_automation	—	—
ibm	cloud_pak_for_business_automation	—	—
ibm	cloud_pak_for_business_automation	24.0.0 – 24.0.0 Interim Fix 006	—
ibm	cloud_pak_for_business_automation	24.0.1 – 24.0.1 Interim Fix 004	—
ibm	cloud_pak_for_business_automation	25.0.0 – 25.0.0 Interim Fix 001	—

CWE-79