Cloud Pak for Business Automation vulnerability

What happened

IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

Affected versions

Cloud Pak for Business Automation: 26.0.0 through 26.0.0 Interim Fix 001 (semver); 25.0.0 through 25.0.0 Interim Fix 005 (semver); 24.0.1 through 24.0.1 Interim Fix 008 (semver); 24.0.0 through 24.0.0 Interim Fix 009 (semver) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.