CVE-2025-36054mediumCWE-79

CVE-2025-36054: fallo de gravedad media en IBM Business Automation Workflow containers

Cross-site scripting vulnerability affect IBM Business Automation Workflow Process Federation Server -

Publicada el

Seguir esta CVE+ Monitorear Business Automation Workflow containers+ Monitorear Business Automation Workflow traditional with Process Federation Server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.1epss 0.2%
IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through 25.0.0-IF001 and IBM Business Automation Workflow traditional with Process Federation Server 24.0.0 through 24.0.1 and 25.0.0 are vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
IBM · Business Automation Workflow containersIBM · Business Automation Workflow traditional with Process Federation Server
CVEs relacionadas — IBM Business Automation Workflow containers

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-13096HIGHXML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow -EPSS 0.5%CVE-2025-36058MEDIUMMultiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025EPSS 0.1%CVE-2025-36059MEDIUMMultiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025EPSS 0.1%