CVE-2025-1837

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1837", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-03-02T12:59:10.812Z", "datePublished": "2026-11-08T15:57:48.551Z", "dateUpdated": "2026-11-09T17:09:25.556Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-08T15:57:48.551Z"}, "title": "Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-650", "description": "CWE-650 Trusting HTTP Permission Methods on the Server Side", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "watsonx Orchestrate Cartridge for Cloud Pak for Data", "versions": [{"status": "affected", "version": "4.8.4", "lessThanOrEqual": "4.8.5", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThanOrEqual": "5.4.2", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7293785", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4\n\n\n\n https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4</p><p><a href=\"https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises</a></p>"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T17:09:17.662202Z", "id": "CVE-2025-1837", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:09:25.556Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1837", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T17:09:17.662202Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:09:22.450Z"}}], "cna": {"title": "Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "watsonx Orchestrate Cartridge for Cloud Pak for Data", "versions": [{"status": "affected", "version": "4.8.4", "versionType": "semver", "lessThanOrEqual": "4.8.5"}, {"status": "affected", "version": "5.0.0", "versionType": "semver", "lessThanOrEqual": "5.4.2"}]}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4\n\n\n\n https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises", "supportingMedia": [{"type": "text/html", "value": "<p>IBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4</p><p><a href=\"https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises</a></p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7293785", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en", "value": "IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-650", "description": "CWE-650 Trusting HTTP Permission Methods on the Server Side"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-08T15:57:48.551Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1837", "state": "PUBLISHED", "dateUpdated": "2026-11-09T17:09:25.556Z", "dateReserved": "2025-03-02T12:59:10.812Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-11-08T15:57:48.551Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:*"], "product": "watsonx Orchestrate Cartridge for Cloud Pak for Data", "vendor": "IBM", "versions": [{"lessThanOrEqual": "4.8.5", "status": "affected", "version": "4.8.4", "versionType": "semver"}, {"lessThanOrEqual": "5.4.2", "status": "affected", "version": "5.0.0", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods."}, {"lang": "es", "value": "IBM watsonx Orchestrate Cartridge para Cloud Pak for Data 4.8.4 hasta la versi\u00f3n 4.8.5 incluida, y 5.0.0 hasta la versi\u00f3n 5.4.2 incluida, podr\u00eda permitir a un usuario autenticado realizar acciones no autorizadas debido a una confianza inadecuada en los m\u00e9todos de permiso del lado del servidor."}], "id": "CVE-2025-1837", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-1837", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T17:09:17.662202Z", "version": "2.0.3"}}]}, "published": "2026-11-08T16:16:35.760", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7293785"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-650"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.8.4,4.8.5]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.4.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "watsonx Orchestrate Cartridge for Cloud Pak for Data", "source": "cna", "vendor": "IBM"}, "product": "watsonx_orchestrate_cartridge_for_cloud_pak_for_data", "vendor": "ibm"}], "created": "2026-11-08T17:30:15.809200+00:00", "updated": "2026-11-10T08:30:23.065746+00:00", "vendors": ["ibm", "ibm$PRODUCT$watsonx_orchestrate_cartridge_for_cloud_pak_for_data"]}