Cross-Site Scripting Vulnerability in IBM Cloud Pak for Data
CVE-2025-0719

6.1MEDIUM

Key Information:

Vendor
IBM
Status
Cloud Pak For Data
Vendor
CVE Published:
26 February 2025

Summary

IBM Cloud Pak for Data versions 4.0.0 to 4.8.5 and 5.0.0 are affected by a cross-site scripting vulnerability. An unauthenticated attacker could exploit this flaw to inject arbitrary JavaScript code into the Web UI. This could potentially manipulate the intended functionality of the application, leading to a risk of credential disclosure within a trusted session, thereby compromising user security.

Affected Version(s)

Cloud Pak for Data 4.0.0 <= 4.8.5

Cloud Pak for Data 5.0.0

References

https://www.ibm.com/support/pages/node/7184173

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.