VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2025/14xxx/CVE-2025-14917.json
T

150 lines
8.2 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-14917",
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"state": "PUBLISHED",
"assignerShortName": "ibm",
"dateReserved": "2025-12-18T19:59:28.180Z",
"datePublished": "2026-03-25T20:13:55.049Z",
"dateUpdated": "2026-03-27T03:55:36.998Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm",
"dateUpdated": "2026-03-25T20:19:13.832Z"
},
"title": "IBM WebSphere Application Server Liberty could provide weaker than expected security",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-1393",
"description": "CWE-1393 Use of Default Password",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "IBM",
"product": "WebSphere Application Server - Liberty",
"versions": [
{
"status": "affected",
"version": "17.0.0.3",
"lessThanOrEqual": "26.0.0.3",
"versionType": "semver"
}
],
"cpes": [
"cpe:2.3:a:ibm:websphere_application_server___liberty:17.0.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:websphere_application_server___liberty:26.0.0.3:*:*:*:*:*:*:*"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.</p>"
}
]
}
],
"references": [
{
"url": "https://www.ibm.com/support/pages/node/7267362",
"tags": [
"vendor-advisory",
"patch"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "MEDIUM",
"baseScore": 6.7,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"solutions": [
{
"lang": "en",
"value": "IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH70078. To determine if a feature is enabled for IBM WebSphere Application Server Liberty, refer to  How to determine if Liberty is using a specific feature https://www.ibm.com/support/pages/node/6553910 . \n\nAttention: After installing the interim fix or fixpack, please follow the additional instructions provided in the interim fix link referenced below to complete the remediation.\n\nFor IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.3 using the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0, appSecurity-4.0 or appSecurity-5.0 feature(s): \n· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves  PH70078 https://www.ibm.com/support/pages/node/7266845  and carefully follow the instructions for steps required after fix installation.\n--OR--\n· Apply Liberty Fix Pack 26.0.0.4 or later (targeted availability 2Q2026).\n\nAdditional interim fixes may be available and linked off the interim fix download page.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR&nbsp;PH70078.&nbsp;To determine if a feature is enabled for IBM WebSphere Application Server Liberty, refer to&nbsp;<a title=\"How to determine if Liberty is using a specific feature\" href=\"https://www.ibm.com/support/pages/node/6553910\" rel=\"nofollow\">How to determine if Liberty is using a specific feature</a>.&nbsp;</p><p><strong>Attention: After installing the interim fix or fixpack, please follow the additional instructions provided in the interim fix link referenced below to complete the remediation.</strong><br><br><strong>For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.3 using the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0, appSecurity-4.0 or appSecurity-5.0 feature(s):&nbsp;</strong><br>· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves&nbsp;<a href=\"https://www.ibm.com/support/pages/node/7266845\" rel=\"nofollow\">PH70078</a>&nbsp;<strong>and carefully follow the instructions for steps required after fix installation.</strong><br>--OR--<br>· Apply Liberty Fix Pack 26.0.0.4 or later (targeted availability 2Q2026).<br><br>Additional interim fixes may be available and linked off the interim fix download page.</p>"
}
]
}
],
"x_generator": {
"engine": "ibm-cvegen"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-03-26T00:00:00+00:00",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3",
"id": "CVE-2025-14917"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-03-27T03:55:36.998Z"
}
}
]
}
}
View Git Blame Copy Permalink