CVE-2025-13096 — XML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow -

Description (CNA)

IBM Business Automation Workflow containers V25.0.0 through V25.0.0-IF007, V24.0.1 - V24.0.1-IF007, V24.0.0 - V24.0.0-IF007 and IBM Business Automation Workflow traditional V25.0.0, V24.0.1, V24.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Affected (CNA)

Vendor / product	Versions
IBM / Business Automation Workflow containers	affected V25.0.0 through V25.0.0-IF002; affected V24.0.1 through V24.0.1-IF005; affected V24.0.0 through V24.0.0-IF007
IBM / Business Automation Workflow traditional	affected 25.0.0; affected 24.0.1; affected 24.0.0

CWE

CWE-918

References

https://www.ibm.com/support/pages/node/7259321

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.