CVE-2025-36220
SQL Injection in IBM Cloud Pak for Data System
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | cloud_pak_for_data_system | 11.3.0.2 |
| ibm | cloud_pak_for_data_system | 11.3.1.1 |
| ibm | cloud_pak_for_data_system | From 11.3.0.2 (inc) to 11.3.1.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-36220 is an SQL injection vulnerability in IBM Cloud Pak for Data System - Cyclops versions 11.3.0.2 through Interim Fix 002. This flaw allows a remote attacker to send specially crafted SQL statements that exploit improper neutralization of special elements in SQL commands.
By exploiting this vulnerability, the attacker could view, add, modify, or delete information stored in the back-end database.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing a remote attacker to manipulate your database through SQL injection. Specifically, the attacker could view sensitive data, add unauthorized data, modify existing data, or delete important information in the back-end database.
The attack requires only network access and low privileges, and no user interaction is needed, making it easier for attackers to exploit.
The severity is rated as medium with a CVSS base score of 4.3.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in IBM Cloud Pak for Data System Cyclops (version 11.3.0.2-IF2) is an SQL injection flaw that can be exploited remotely.
There are no workarounds currently available to mitigate this issue.
The immediate step to mitigate this vulnerability is to update the IBM Cloud Pak for Data System to the fixed version 11.3.1.1-WS-ICPDS-CYCLOPS-fp278500 provided by IBM.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows a remote attacker to view, add, modify, or delete information in the back-end database via SQL injection.
Such unauthorized access and manipulation of data could potentially lead to non-compliance with data protection regulations like GDPR and HIPAA, which require the protection of sensitive data from unauthorized access and alteration.
However, the provided information does not explicitly state the impact on compliance with these standards.