CVE-2025-36320

Received Received - Intake

Stored XSS in IBM watsonx.data Intelligence

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: IBM Corporation

Description

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2025-36320

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	watsonx.data_intelligence	5.2.0
ibm	watsonx.data_intelligence	5.2.1
ibm	watsonx.data_intelligence	5.2.2
ibm	watsonx.data_intelligence	5.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0. It is a stored cross-site scripting (XSS) vulnerability that allows an authenticated user to embed arbitrary JavaScript code into the Web UI.

By injecting this malicious script, the attacker can alter the intended functionality of the application.

Impact Analysis

The vulnerability can lead to the disclosure of credentials within a trusted session, as the injected JavaScript code can manipulate the Web UI and potentially capture sensitive information.

Since the attacker must be authenticated, the risk is limited to users who have access, but the impact includes loss of confidentiality and integrity of user data.

Compliance Impact

The vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.

Such credentials disclosure could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and user credentials.

However, specific effects on compliance with these standards are not detailed in the provided information.

Hi! I’m here to help you understand CVE-2025-36320. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70