CVE-2025-36436

published 2026-02-02

CVE-2025-36436: IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007…

medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
ibm	cloud_pak_for_business_automation	—	—
ibm	cloud_pak_for_business_automation	—	—
ibm	cloud_pak_for_business_automation	—	—
ibm	cloud_pak_for_business_automation	24.0.0 – 24.0.0 Interim Fix 007	—
ibm	cloud_pak_for_business_automation	24.0.1 – 24.0.1 Interim Fix 005	—
ibm	cloud_pak_for_business_automation	25.0.0 – 25.0.0 Interim Fix 002	—

CWE-79