Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for 24.0.0-IF007, 24.0.1-IF005 and 25.0.0-IF002
Summary
| CVE | CVE-2025-36172 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-11-03 22:18:51 UTC |
| Updated | 2026-06-17 09:14:34 UTC |
| Description | IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 001, 24.0.1 through 24.0.1 Interim Fix 004, 24.0.0 through 24.0.0 Interim Fix 006, and earlier unsupported releases IBM Business Automation Workflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. |
Risk And Classification
Primary CVSS: v3.1 5.4 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.001770000 probability, percentile 0.068380000 (date 2026-10-18)
Problem Types: CWE-79 | CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 5.4 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| 3.1 | [email protected] | Secondary | 6.4 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
| 3.1 | CNA | CVSS | 6.4 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ibm | Cloud Pak For Business Automation | 24.0.0 | - | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.0 | interim_fix_001 | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.0 | interim_fix_002 | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.0 | interim_fix_003 | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.0 | interim_fix_004 | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.0 | interim_fix_005 | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.0 | interim_fix_006 | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.1 | - | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.1 | interim_fix_001 | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.1 | interim_fix_002 | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.1 | interim_fix_004 | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 25.0.0 | - | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 25.0.0 | interim_fix_001 | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | IBM | Cloud Pak For Business Automation | affected 25.0.0 25.0.0 Interim Fix 001 semver | Not specified |
| CNA | IBM | Cloud Pak For Business Automation | affected 24.0.1 24.0.1 Interim Fix 004 semver | Not specified |
| CNA | IBM | Cloud Pak For Business Automation | affected 24.0.0 24.0.0 Interim Fix 006 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.ibm.com/support/pages/node/7250047 | [email protected] | www.ibm.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: Remediation/Fixes Affected Product(s) Version(s) Remediation / Fix IBM Cloud Pak for Business Automation V25.0.0 - V25.0.0-IF001 Apply security fix 25.0.0-IF002 IBM Cloud Pak for Business Automation V24.0.1 - V24.0.1-IF004 Upgrade and apply security fix 24.0.1-IF005 IBM Cloud Pak for Business Automation V24.0.0 - V24.0.0-IF006 Apply security fix 24.0.0-IF007 IBM Cloud Pak for Business Automation earlier unsupported releases Upgrade to 24.0.0-IF007 or 24.0.1-IF005 or 25.0.0-IF002