Medium · 6.1 CVE-2024-41753 EUVD-2025-13356GHSA-r628-v28r-rwmg

IBM Cloud Pak for Business Automation cross-site scripting

Published May 3, 2025 · Updated Aug 28, 2025 · Assigned by ibm

Vendor: IBM Product: Cloud Pak for Business Automation

Description

IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF004 and 24.0.1 through 24.0.1 IF001 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected products

Vendor	Product	Affected	Fixed
IBM	Cloud Pak for Business Automation	24.0.0 – ≤ 24.0.0 IF004, 24.0.1 – ≤ 24.0.1 IF001	—

References

https://www.ibm.com/support/pages/node/7232197 vendor-advisory patch