CVE-2025-36023

IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and system information due to an indirect object reference through a user-controlled key.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
ibmCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 8%
VendorProductVersion
ibmcloud_pak_for_business_automation
24.0.0
ibmcloud_pak_for_business_automation
24.0.0:interim_fix_001
ibmcloud_pak_for_business_automation
24.0.0:interim_fix_004
ibmcloud_pak_for_business_automation
24.0.0:interim_fix_005
ibmcloud_pak_for_business_automation
24.0.1
ibmcloud_pak_for_business_automation
24.0.1:interim_fix_001
ibmcloud_pak_for_business_automation
24.0.1:interim_fix_002
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.ibm.com/support/pages/node/7241570