2.7
Low
CVE-2025-0166 Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge
Description
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be accessible.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NExploitable remotely over the network, with an administrator account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| watsonx Orchestrate Cartridge for Cloud Pak for Data 5.0 | 5.0.0 → 5.4.2 | No fix stated |
| watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8 | 4.8.4 → 4.8.5 | No fix stated |