CVE-2025-36054mediumCWE-79

CVE-2025-36054: falha de média gravidade em IBM Business Automation Workflow containers

Cross-site scripting vulnerability affect IBM Business Automation Workflow Process Federation Server -

Publicada em

Seguir esta CVE+ Monitorar Business Automation Workflow containers+ Monitorar Business Automation Workflow traditional with Process Federation Server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 0.2%
IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through 25.0.0-IF001 and IBM Business Automation Workflow traditional with Process Federation Server 24.0.0 through 24.0.1 and 25.0.0 are vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
IBM · Business Automation Workflow containersIBM · Business Automation Workflow traditional with Process Federation Server
CVEs relacionadas — IBM Business Automation Workflow containers

No mesmo produto, das mais perigosas para as menos.

CVE-2025-13096HIGHXML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow -EPSS 0.5%CVE-2025-36058MEDIUMMultiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025EPSS 0.1%CVE-2025-36059MEDIUMMultiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025EPSS 0.1%