{"id":2744,"date":"2025-05-03T06:33:46","date_gmt":"2025-05-03T06:33:46","guid":{"rendered":"http:\/\/localhost\/?p=2744"},"modified":"2025-05-03T06:33:46","modified_gmt":"2025-05-03T06:33:46","slug":"security-bulletin-multiple-vulnerabilities-affect-ibm-business-automation-workflow-cve-2025-27789-cv","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=2744","title":{"rendered":"Security Bulletin: Multiple vulnerabilities affect IBM Business Automation Workflow – CVE-2025-27789, CVE-2024-57965, CVE-2025-27152, CVE-2024-55565"},"content":{"rendered":"
\n

Vulnerability Details<\/h2>\n
\n

Basic Information<\/h3>\n\n\n\n\n\n\n
Title<\/th>\nSecurity Bulletin: Multiple vulnerabilities affect IBM Business Automation Workflow – CVE-2025-27789, CVE-2024-57965, CVE-2025-27152, CVE-2024-55565<\/td>\n<\/tr>\n
Type<\/th>\nibm<\/td>\n<\/tr>\n
Published<\/th>\n2025-05-03T05:52:10<\/td>\n<\/tr>\n
Last Seen<\/th>\n2025-05-03T10:56:46<\/td>\n<\/tr>\n
CVSS Score<\/th>\n6.2 (MEDIUM)<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

CVSS v3 Details<\/h3>\n\n\n\n\n\n\n\n\n\n
Attack Vector<\/th>\nLOCAL<\/td>\n<\/tr>\n
Attack Complexity<\/th>\nLOW<\/td>\n<\/tr>\n
Privileges Required<\/th>\nNONE<\/td>\n<\/tr>\n
User Interaction<\/th>\nNONE<\/td>\n<\/tr>\n
Scope<\/th>\nUNCHANGED<\/td>\n<\/tr>\n
Confidentiality Impact<\/th>\nNONE<\/td>\n<\/tr>\n
Integrity Impact<\/th>\nNONE<\/td>\n<\/tr>\n
Availability Impact<\/th>\nHIGH<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

CVE Information<\/h3>\n\n\n\n\n
CVE IDs<\/th>\nCVE-2024-55565, CVE-2024-57965, CVE-2025-27152, CVE-2025-27789<\/td>\n<\/tr>\n
CWE<\/th>\n<\/td>\n<\/tr>\n
Bulletin Family<\/th>\nsoftware<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

Description<\/h3>\n
\n ## Summary<\/p>\n

Some IBM Business Automation Workflow user interfaces may be affected by vulnerabilities in JavaScript libraries.<\/p>\n

## Vulnerability Details<\/p>\n

**CVEID:**CVE-2025-27789
\n**DESCRIPTION:** Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel\/helpers` and `@babel\/runtime` 7.26.10 and 8.0.0-alpha.17. It’s likely that individual users do not directly depend on `@babel\/helpers`, and instead depend on `@babel\/core` (which itself depends on `@babel\/helpers`). Upgrading to `@babel\/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel\/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.
\n**CWE:**CWE-1333: Inefficient Regular Expression Complexity
\n**CVSS Source:** security-advisories@github.com
\n**CVSS Base score:** 6.2
\n**CVSS Vector:**(CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:H) <\/p>\n

**CVEID:**CVE-2024-57965
\n**DESCRIPTION:** In axios before 1.7.8, lib\/helpers\/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute(‘href’,href) call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability.
\n**CWE:**CWE-346: Origin Validation Error
\n**CVSS Source:** cve@mitre.org
\n**CVSS Base score:** 0
\n**CVSS Vector:**(CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:N\/S:C\/C:N\/I:N\/A:N) <\/p>\n

**CVEID:**CVE-2025-27152
\n**DESCRIPTION:** axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if \u2060baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.
\n**CWE:**CWE-918: Server-Side Request Forgery (SSRF)
\n**CVSS Source:** IBM
\n**CVSS Base score:** 7.5
\n**CVSS Vector:**(CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N) <\/p>\n

**CVEID:**CVE-2024-55565
\n**DESCRIPTION:** nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.
\n**CWE:**CWE-835: Loop with Unreachable Exit Condition (‘Infinite Loop’)
\n**CVSS Source:** CISA ADP
\n**CVSS Base score:** 4.3
\n**CVSS Vector:**(CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:N)<\/p>\n

## Affected Products and Versions<\/p>\n

Affected Product(s)| Version(s)| Status
\n—|—|—
\nIBM Business Automation Workflow containers| V24.0.1 – V24.0.1-IF001
\nV24.0.0 – V24.0.0-IF004
\nearlier unsupported versions | affected
\nIBM Business Automation Workflow traditional| V24.0.0 – V24.0.1
\nearlier unsupported versions| affected <\/p>\n

For earlier and unsupported versions of the products, IBM recommends upgrading to a fixed, supported version of the product.<\/p>\n

## Remediation\/Fixes<\/p>\n

The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR DT423873 and DT433330 as soon as practical.<\/p>\n

Affected Product(s)| Version(s)| Remediation \/ Fix
\n—|—|—
\nIBM Business Automation Workflow containers| V24.0.1 – V24.0.1-IF001| Apply 24.0.1-IF002
\nIBM Business Automation Workflow containers| V24.0.0 – V24.0.0-IF004| Apply 24.0.0-IF005
\nIBM Business Automation Workflow containers| earlier unsupported versions| Upgrade to 24.0.0-IF005 (or later) or 24.0.1-IF002 (or later)
\nIBM Business Automation Workflow traditional | V24.0.1
\nV24.0.0| Apply APARs DT423873 and DT433330
\nIBM Business Automation Workflow traditional| earlier unsupported versions| Upgrade to 24.0.0 or 24.0.1 and apply APARs DT423873 and DT433330 <\/p>\n

## Workarounds and Mitigations<\/p>\n

None<\/p>\n

##\n <\/p><\/div>\n<\/p><\/div>\n

\n

Impact Assessment<\/h3>\n\n\n\n
Base Score<\/th>\n6.2<\/td>\n<\/tr>\n
Severity<\/th>\nMEDIUM<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

View full CVE details<\/a><\/p>\n<\/p><\/div>\n<\/div>\n