CVE-2025-36093
Ibm Cloud Pak For Business Automation 24.0.0 … 25.0.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NSummary
CVE-2025-36093 is a medium-severity Client-Side Enforcement of Server-Side Security (CWE-602) vulnerability in Ibm Cloud Pak For Business Automation. Its CVSS base score is 4.8 (Medium).
Operationally, ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-37490
Vulnerability Data
IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man in the middle techniques due to improper access controls.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces server-side access control decisions so that client-side checks (CWE-602) cannot be bypassed by MITM tampering.
Requires cryptographic protection of transmitted data to defeat man-in-the-middle interception or modification of requests and responses.
Ensures session authenticity and integrity, preventing MITM attackers from hijacking or replaying sessions after bypassing weak client-side controls.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles discourage client-side trust but do not directly address this weakness.
Security testing can detect client-side enforcement but is not the primary mitigation.
Information access restriction is undermined when the client is trusted to enforce it.
Secure development lifecycle mandates server-side validation and prevents reliance on client enforcement.
Application security requirements explicitly call for server-side enforcement of security mechanisms.
Secure coding standards require server-side checks and reject client-only enforcement.