« Volver al listado

CVE-2025-36093

Estado: AnalizadaAlta (7.4)—

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man in the middle techniques due to improper access controls.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CWE-602 (improper access controls) + AV:N sin interacción user ni privilegios previos, combinado con descripción explícita de 'man in the middle techniques' justifica T1557. Los impactos C:H e I:H indican acceso no autorizado a contenido y capacidad de modificar datos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Network SegmentationEncrypt Sensitive InformationUser TrainingRestrict File and Directory PermissionsRemote Data StorageNetwork Intrusion Prevention

Tecnologías afectadas (1)

IBM — Cloud PAK FOR Business Automation

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-36093",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-36093",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-11-03T16:25:13.912411Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cloud_pak_for_business_automation:25.0.0:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Cloud Pak For Business Automation",
          "versions": [
            {
              "status": "affected",
              "version": "25.0.0"
            },
            {
              "status": "affected",
              "version": "24.0.1"
            },
            {
              "status": "affected",
              "version": "24.0.0"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-11-03T16:15:34.763",
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7249999",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-602"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man in the middle techniques due to improper access controls."
    }
  ],
  "lastModified": "2026-06-17T09:14:28.113",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF879B84-21B0-4FD4-AD2E-7F29EBDD218A"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_001:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "496D1A48-3403-471F-AD07-AEC7E5000AD8"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_002:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA215EC3-DDFE-494D-862C-35CA30D9BEDE"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_003:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "969ED94C-DB65-482F-B8B8-251B56DE264D"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_004:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1810412-5987-4F53-A81E-096A4F0187B5"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F68528C5-034B-4B2C-8745-B969B14B52C5"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:interim_fix_001:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EADE80E3-4E60-4154-A559-93E2325D799A"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:interim_fix_002:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D01FC35C-29F1-4D57-8804-07A5C1E9EA85"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:interim_fix_004:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D682E4B-DA22-4F88-A38F-76FF080AE0B5"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:25.0.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70431A72-663D-432E-9D94-5BBE380E06AB"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_for_business_automation:25.0.0:interim_fix_001:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33128B64-7030-4A4E-8EF2-E285AF44F99F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}