{"affected":[{"product":"watsonx Orchestrate Cartridge for Cloud Pak for Data","source":"CNA: ibm","vendor":"IBM","versions":[{"lessThanOrEqual":"4.8.5","status":"affected","version":"4.8.4","versionType":"semver"},{"lessThanOrEqual":"5.4.2","status":"affected","version":"5.0.0","versionType":"semver"}]}],"cveId":"CVE-2025-1837","cwes":["CWE-650"],"description":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.4,"severity":"medium","source":"CNA: ibm","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794153468551,"publishedAt":1794153468551,"references":[{"source":"CNA: ibm","tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7293785"}],"remediation":[{"kind":"fix","source":"CNA: ibm","text":"IBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4\n\n\n\n https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises"},{"kind":"fix","source":"CNA: ibm","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.ibm.com/support/pages/node/7293785"}],"revision":"f03c4beae79351380a21fd46c7c25e872db52f67e3043405ce62492b327ba003","sources":[{"modifiedAt":1794153468551,"name":"CNA: ibm","retrievedAt":1794154102915,"url":"https://www.cve.org/CVERecord?id=CVE-2025-1837"}],"ssvc":null,"status":"published","title":"Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge","updatedAt":1794154102915}