by Kastro
Paper/Archive/CVE-2025-0165

CVE-2025-0165

IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data — IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data SQL injection

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 35.0.350 × 207.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data 4.8.4, 4.8.5, and 5.0.0 through 5.2.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

Affected

ProductAffectedFixed inSource
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data4.8.4 – 4.8.5–CNA
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data5.0.0 – 5.2.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ibm (CNA)7.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

patchibm.com/support/pages/node/7243596