5.4
Medium
CVE-2025-1837 Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge
Description
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitable remotely over the network, without an account and if a user takes an action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| watsonx Orchestrate Cartridge for Cloud Pak for Data 5.0 | 5.0.0 → 5.4.2 | No fix stated |
| watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8 | 4.8.4 → 4.8.5 | No fix stated |