Medium WID-SEC-2025-0930 5 CVEs

IBM Business Automation Workflow: Mehrere Schwachstellen

Published May 4, 2025 · Updated May 4, 2025 · de-DE

Vendor: IBM Product: Business Automation Workflow Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um einen Denial of Service Angriff durchzuführen, oder Informationen auszuspähen.

Product

IBM Business Automation Workflow ist eine Lösung zur Automatisierung von Arbeitsabläufen.

Vulnerabilities 5

High 7.7

CVE-2025-27152 Public exploit

Possible SSRF and Credential Leakage via Absolute URL in axios Requests

axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF…

axios axios prism kubeflow-pipelines-apiserver Debian Ubuntu Wolfi npm

Mar 7, 2025
Medium 6.5

CVE-2025-1838

IBM Cloud Pak for Business Automation denial of service

IBM Cloud Pak for Business Automation 24.0.0 and 24.0.1 through 24.0.1 IF001 Authoring allows an authenticated user to bypass client-side data validation in an authoring user interface which could cause a denial of service.

IBM Cloud Pak for Business Automation

May 3, 2025
Medium 6.2

CVE-2025-27789

Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups

Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic comp…

babel babel katib-suggestion-hyperopt katib-earlystopping Ubuntu Wolfi npm

Mar 11, 2025
Medium 4.3

CVE-2024-55565

Predictable results in nanoid generation when given non-integer values

nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.

katib-suggestion-hyperopt katib-earlystopping katib-suggestion-skopt-enas katib-suggestion-hyperband Debian Ubuntu Wolfi npm

Dec 9, 2024
Medium 4.3

CVE-2025-1495

IBM Business Automation Workflow missing authentication

IBM Business Automation Workflow 24.0.0 and 24.0.1 through 24.0.1 IF001 Center may leak sensitive information due to missing authorization validation.

IBM IBM Business Automation Workflow

May 3, 2025

Revision history

2025-05-04 #1
Initiale Fassung

References

IBM Security Bulletin vom 2025-05-04
https://www.ibm.com/support/pages/node/7232428
IBM Security Bulletin vom 2025-05-04
https://www.ibm.com/support/pages/node/7232433
IBM Security Bulletin vom 2025-05-04
https://www.ibm.com/support/pages/node/7232434