Cloud Pak for Business Automation vulnerability

What happened

IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected versions

Cloud Pak for Business Automation: 26.0.0 through 26.0.0 Interim Fix 001 (semver); 25.0.0 through 25.0.0 Interim Fix 005 (semver); 24.0.1 through 24.0.1 Interim Fix 008 (semver); 24.0.0 through 24.0.0 Interim Fix 009 (semver) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.