PT-2025-44796 · Ibm · Ibm Cloud Pak For Business Automation+1

Published 2025-11-03 · Updated 2025-11-04 · CVE-2025-36172

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Business Automation versions 25.0.0 through 25.0.0 Interim Fix 001 IBM Cloud Pak for Business Automation versions 24.0.1 through 24.0.1 Interim Fix 004 IBM Cloud Pak for Business Automation versions 24.0.0 through 24.0.0 Interim Fix 006 IBM Business Automation Workflow earlier unsupported releases

Description The software is susceptible to a stored cross-site scripting issue. An authenticated user can inject arbitrary JavaScript code into the Web UI, potentially modifying the intended functionality and leading to credentials disclosure within a trusted session.

Recommendations IBM Cloud Pak for Business Automation version 25.0.0 Interim Fix 002 or later should be installed. IBM Cloud Pak for Business Automation version 24.0.1 Interim Fix 005 or later should be installed. IBM Cloud Pak for Business Automation version 24.0.0 Interim Fix 007 or later should be installed. Earlier unsupported releases should be upgraded to a supported version.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-36172

Affected Products

Ibm Business Automation Workflow

Ibm Cloud Pak For Business Automation

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-36172 · Security Note
• https://osv.dev/vulnerability/CVE-2025-36172 · Vendor Advisory
• https://t.me/CVEtracker/36454 · Telegram Post
• https://ibm.com/support/pages/node/7250047 · Patch, Vendor Advisory