5.4

CVE-2025-36436

Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007  is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Cloud Pak For Business Automation Version 24.0.0 Update -
Ibm ≫ Cloud Pak For Business Automation Version 24.0.0 Update interim_fix_001
Ibm ≫ Cloud Pak For Business Automation Version 24.0.0 Update interim_fix_002
Ibm ≫ Cloud Pak For Business Automation Version 24.0.0 Update interim_fix_003
Ibm ≫ Cloud Pak For Business Automation Version 24.0.0 Update interim_fix_004
Ibm ≫ Cloud Pak For Business Automation Version 24.0.0 Update interim_fix_005
Ibm ≫ Cloud Pak For Business Automation Version 24.0.0 Update interim_fix_006
Ibm ≫ Cloud Pak For Business Automation Version 24.0.0 Update interim_fix_007
Ibm ≫ Cloud Pak For Business Automation Version 24.0.1 Update -
Ibm ≫ Cloud Pak For Business Automation Version 24.0.1 Update interim_fix_001
Ibm ≫ Cloud Pak For Business Automation Version 24.0.1 Update interim_fix_002
Ibm ≫ Cloud Pak For Business Automation Version 24.0.1 Update interim_fix_004
Ibm ≫ Cloud Pak For Business Automation Version 24.0.1 Update interim_fix_005
Ibm ≫ Cloud Pak For Business Automation Version 25.0.0 Update -
Ibm ≫ Cloud Pak For Business Automation Version 25.0.0 Update interim_fix_001
Ibm ≫ Cloud Pak For Business Automation Version 25.0.0 Update interim_fix_002
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.21% 0.11
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
IBM 6.4 3.1 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.ibm.com/support/pages/node/7259318
Vendor Advisory