« Back to list

CVE-2025-1838

Status: AnalyzedMedium (6.5)—

IBM Cloud Pak for Business Automation

24.0.0 and 24.0.1 through 24.0.1 IF001

Authoring allows an authenticated user to bypass client-side data validation in an authoring user interface which could cause a denial of service.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

IBM — Cloud PAK FOR Business Automation

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2025-1838",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-1838",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-05T14:40:22.215378Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:if004:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cloud_pak_for_business_automation:23.0.1:if001:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Cloud Pak for Business Automation",
          "versions": [
            {
              "status": "affected",
              "version": "24.0.1",
              "versionType": "semver",
              "lessThanOrEqual": "24.0.1 IF001"
            },
            {
              "status": "affected",
              "version": "24.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "24.0.0 IF004"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-05-03T19:15:48.607",
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7232429",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-602"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Cloud Pak for Business Automation\n\n 24.0.0 and 24.0.1 through 24.0.1 IF001 \n\nAuthoring allows an authenticated user to bypass client-side data validation in an authoring user interface which could cause a denial of service."
    },
    {
      "lang": "es",
      "value": "IBM Cloud Pak for Business Automation 24.0.0 y 24.0.1 a 24.0.1 IF001 La creación permite que un usuario autenticado omita la validación de datos del lado del cliente en una interfaz de usuario de creación, lo que podría provocar una denegación de servicio."
    }
  ],
  "lastModified": "2026-06-17T08:39:52.160",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6DE0E647-C352-4AFB-BA14-7E3B6186EDB1"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF879B84-21B0-4FD4-AD2E-7F29EBDD218A"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_001:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "496D1A48-3403-471F-AD07-AEC7E5000AD8"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_002:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA215EC3-DDFE-494D-862C-35CA30D9BEDE"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_003:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "969ED94C-DB65-482F-B8B8-251B56DE264D"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_004:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1810412-5987-4F53-A81E-096A4F0187B5"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F68528C5-034B-4B2C-8745-B969B14B52C5"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:interim_fix_001:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EADE80E3-4E60-4154-A559-93E2325D799A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}