CVE-2025-36327
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability in IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0 allows an authenticated user to bypass security controls and perform unauthorized actions due to client-side enforcement of server-side security.
Risk Assessment
The risk is that an authenticated user may gain access to functions or data they are not authorized to, potentially leading to a breach of confidentiality, integrity, or availability of the system.
Recommendation
It is recommended to immediately update IBM watsonx.data intelligence to the latest available version that includes a fix for this vulnerability, and to implement server-side security enforcement mechanisms.
Other vulnerabilities in IBM watsonx.data intelligence
See all- CVE-2025-36336Medium
IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0 transmit data in clear text, allowing an attacker to obtain sensitive information using man-in-the-middle techniques.
- CVE-2025-36333Medium
A vulnerability in IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0 allows an authenticated user to perform unauthorized actions due to improper enforcement of behavioral workflow.
- CVE-2025-36328Medium
A vulnerability in IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0 allows a remote attacker to obtain sensitive information through detailed error messages returned in the browser. This information could be used in further attacks against the system.
- CVE-2025-36324Medium
IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0 are vulnerable to server-side request forgery (SSRF). An authenticated attacker can send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- CVE-2025-36323Medium
Cross-site scripting vulnerability in IBM watsonx.data intelligence allows an authenticated user to embed arbitrary JavaScript code in the Web UI, potentially leading to credential disclosure within a trusted session.
- CVE-2025-36321Medium
IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0 are vulnerable to HTML injection. A remote attacker can inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
- CVE-2025-36320Medium
Stored cross-site scripting vulnerability in IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0. Allows an authenticated user to embed arbitrary JavaScript code in the Web UI, potentially leading to credential disclosure within a trusted session.
- CVE-2025-36319Medium
A vulnerability in IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0 allows an authenticated user to cause a temporary denial of service via a specially crafted HTTP request. The issue stems from improper allocation of resource throttling.
- CVE-2025-12530Medium
IBM watsonx.data intelligence versions 5.2.2, 5.3.0, 5.3.1, 5.3.1 through Patch 1 transmits data in clear text, which could allow an attacker to obtain sensitive information using man-in-the-middle techniques.
Original NVD description (English source)
IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to bypass security controls and perform unauthorized actions due to client-side enforcement of sever-side security.