{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-36023","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","state":"PUBLISHED","assignerShortName":"ibm","dateReserved":"2025-04-15T21:16:08.835Z","datePublished":"2025-08-08T14:51:12.631Z","dateUpdated":"2025-08-08T15:07:16.477Z"},"containers":{"cna":{"affected":[{"cpes":["cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:ifix5:*:*:*:*:*:*","cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:ifix2:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"Cloud Pak for Business Automation","vendor":"IBM","versions":[{"lessThanOrEqual":"24.0.0 IF005","status":"affected","version":"24.0.0","versionType":"semver"},{"lessThanOrEqual":"24.0.1 IF002","status":"affected","version":"24.0.1","versionType":"semver"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and system information due to an indirect object reference through a user-controlled key."}],"value":"IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and system information due to an indirect object reference through a user-controlled key."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","description":"CWE-639 Authorization Bypass Through User-Controlled Key","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2025-08-08T14:51:12.631Z"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7241570"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Affected Product(s)  Version(s)  Remediation / Fix<br>IBM Cloud Pak for Business Automation  V24.0.1 - V24.0.1-IF002  Apply security fix 24.0.1-IF004 or upgrade to V25.0.0<br>IBM Cloud Pak for Business Automation  V24.0.0 - V24.0.0-IF005  Upgrade and apply security fix 24.0.0-IF006 or upgrade to 24.0.1-IF004 or upgrade to V25.0.0<br>IBM Cloud Pak for Business Automation  earlier unsupported releases  Upgrade to 24.0.0-IF006 or upgrade to 24.0.1-IF004 or upgrade to V25.0.0<br><br>"}],"value":"Affected Product(s)  Version(s)  Remediation / Fix\nIBM Cloud Pak for Business Automation  V24.0.1 - V24.0.1-IF002  Apply security fix 24.0.1-IF004 or upgrade to V25.0.0\nIBM Cloud Pak for Business Automation  V24.0.0 - V24.0.0-IF005  Upgrade and apply security fix 24.0.0-IF006 or upgrade to 24.0.1-IF004 or upgrade to V25.0.0\nIBM Cloud Pak for Business Automation  earlier unsupported releases  Upgrade to 24.0.0-IF006 or upgrade to 24.0.1-IF004 or upgrade to V25.0.0"}],"source":{"discovery":"UNKNOWN"},"title":"IBM Cloud Pak for Business Automation security bypass","x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-08-08T15:07:06.250680Z","id":"CVE-2025-36023","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-08-08T15:07:16.477Z"}}]}}