CVE-2025-33116

MediumCVSS 4.4

Published: 25/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

IBM Watson Studio versions 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. An authenticated user can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credentials disclosure within a trusted session.

Risk Assessment

The risk includes credential theft and session hijacking, potentially leading to unauthorized access to data and systems.

Recommendation

It is recommended to update IBM Watson Studio to the latest patched version and implement input filtering and validation mechanisms in the web UI.

Other vulnerabilities in IBM Watson Studio

CVE-2024-49790Medium
IBM Watson Studio on Cloud Pak for Data 4.0 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credentials disclosure within a trusted session.

Original NVD description (English source)

IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS