CVE-2025-36054
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through 25.0.0-IF001 and IBM Business Automation Workflow traditional with Process Federation Server 24.0.0 through 24.0.1 and 25.0.0 are vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Risk Assessment
XSS in the management interface can allow an attacker to execute malicious code in a user's browser, potentially leading to credential theft or session takeover. The risk is high due to the possibility of exploitation by an unauthenticated attacker.
Recommendation
Apply the latest interim fixes (IF) for IBM Business Automation Workflow that address this vulnerability. Additionally, implement XSS protections such as Content Security Policy (CSP) and input validation.
Other vulnerabilities in IBM Business Automation Workflow
See all- CVE-2026-12752High
IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- CVE-2026-12742Medium
IBM Business Automation Workflow (containers and traditional) lacks authorization controls, allowing an authenticated attacker to trigger restricted import actions. The flaw stems from insufficient enforcement of permissions on import operations.
- CVE-2026-12756High
IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- CVE-2026-13107High
IBM Business Automation Workflow (containers and traditional) may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default.
- CVE-2026-12730Low
IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 fails to properly verify that the hostname matches the server certificate, potentially allowing connections to an attacker-controlled server.
- CVE-2026-1248Medium
IBM Business Automation Workflow containers and traditional may leak information about its database structure in error messages.
Original NVD description (English source)
IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through 25.0.0-IF001 and IBM Business Automation Workflow traditional with Process Federation Server 24.0.0 through 24.0.1 and 25.0.0 are vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS