CVE-2024-49790

MediumCVSS 5.4

Published: 28/08/2025(UTC)Updated: 26/09/2026(UTC)Translated: 27/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

IBM Watson Studio on Cloud Pak for Data 4.0 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credentials disclosure within a trusted session.

Risk Assessment

Risk of credential disclosure within a trusted session and alteration of application functionality, potentially leading to security compromise.

Recommendation

Apply IBM-provided patches and restrict user privileges.

Other vulnerabilities in IBM Watson Studio

CVE-2025-33116Medium
IBM Watson Studio versions 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. An authenticated user can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credentials disclosure within a trusted session.

Original NVD description (English source)

IBM Watson Studio on Cloud Pak for Data 4.0 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS