IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through 25.0.0-IF001 and IBM Business Automation Workflow traditional with Process Federation Server 24.0.0 through 24.0.1 and 25.0.0 are vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
References
| Link | Resource |
|---|---|
| https://www.ibm.com/support/pages/node/7250261 | Vendor Advisory Patch |
Configurations
Configuration 1 (hide)
|
History
12 Dec 2025, 15:21
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:ibm:business_automation_workflow:25.0.0:-:*:*:containers:*:*:* cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if004:*:*:containers:*:*:* cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if001:*:*:containers:*:*:* cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if004:*:*:containers:*:*:* cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if001:*:*:containers:*:*:* cpe:2.3:a:ibm:process_federation_server:25.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:business_automation_workflow:-:*:*:*:traditional:*:*:* cpe:2.3:a:ibm:business_automation_workflow:24.0.1:-:*:*:containers:*:*:* cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if005:*:*:containers:*:*:* cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if002:*:*:containers:*:*:* cpe:2.3:a:ibm:process_federation_server:24.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:business_automation_workflow:24.0.0:-:*:*:containers:*:*:* cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if003:*:*:containers:*:*:* cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if002:*:*:containers:*:*:* cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if006:*:*:containers:*:*:* cpe:2.3:a:ibm:process_federation_server:24.0.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if001:*:*:containers:*:*:* |
|
| First Time |
Ibm
Ibm process Federation Server Ibm business Automation Workflow |
|
| References | () https://www.ibm.com/support/pages/node/7250261 - Vendor Advisory, Patch |
06 Nov 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-06 15:15
Updated : 2025-12-12 15:21
NVD link : CVE-2025-36054
Mitre link : CVE-2025-36054
CVE.ORG link : CVE-2025-36054
JSON object : View
Products Affected
ibm
- process_federation_server
- business_automation_workflow
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')