207 lines
9.2 KiB
JSON
207 lines
9.2 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2025-36075",
|
||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "ibm",
|
||
"dateReserved": "2025-04-15T21:16:13.122Z",
|
||
"datePublished": "2026-11-08T16:07:01.387Z",
|
||
"dateUpdated": "2026-11-09T17:11:33.701Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||
"shortName": "ibm",
|
||
"dateUpdated": "2026-11-08T16:07:01.387Z"
|
||
},
|
||
"title": "IBM Safer Payments could allow an authenticated user to obtain sensitive information",
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"cweId": "CWE-1287",
|
||
"description": "CWE-1287 Improper Validation of Specified Type of Input",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "IBM",
|
||
"product": "Safer Payments",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "6.4.0.00",
|
||
"lessThanOrEqual": "6.4.2.11",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "6.5.0.00",
|
||
"lessThanOrEqual": "6.5.0.09",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "6.6.0.00",
|
||
"lessThanOrEqual": "6.6.0.07",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "6.7.0.00",
|
||
"lessThanOrEqual": "6.7.0.03",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "6.8.0.00",
|
||
"versionType": "semver"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information.",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "<p>IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information.</p>"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://www.ibm.com/support/pages/node/7293213",
|
||
"tags": [
|
||
"vendor-advisory",
|
||
"patch"
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
],
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"attackVector": "NETWORK",
|
||
"attackComplexity": "HIGH",
|
||
"privilegesRequired": "LOW",
|
||
"userInteraction": "NONE",
|
||
"scope": "UNCHANGED",
|
||
"confidentialityImpact": "HIGH",
|
||
"integrityImpact": "NONE",
|
||
"availabilityImpact": "NONE",
|
||
"baseSeverity": "MEDIUM",
|
||
"baseScore": 5.3,
|
||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
|
||
}
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Update IBM Safer Payments to version 6.4.2.12, 6.5.0.10, 6.6.0.08, 6.7.0.04, 6.8.0.01 or higher.\n\n\n\nRefer to the IBM Safer Payments documentation https://www.ibm.com/docs/en/safer-payments to download the updates.",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "<p>Update IBM Safer Payments to version 6.4.2.12, 6.5.0.10, 6.6.0.08, 6.7.0.04, 6.8.0.01 or higher.</p><p>Refer to the <a href=\"https://www.ibm.com/docs/en/safer-payments\" rel=\"nofollow\">IBM Safer Payments documentation</a> to download the updates.</p>"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"operator": "OR",
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:a:ibm:safer_payments:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.4.0.00",
|
||
"versionEndIncluding": "6.4.2.11"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:a:ibm:safer_payments:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.5.0.00",
|
||
"versionEndIncluding": "6.5.0.09"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:a:ibm:safer_payments:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.6.0.00",
|
||
"versionEndIncluding": "6.6.0.07"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:a:ibm:safer_payments:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.7.0.00",
|
||
"versionEndIncluding": "6.7.0.03"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:a:ibm:safer_payments:6.8.0.00:*:*:*:*:*:*:*"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-11-09T17:10:51.462397Z",
|
||
"id": "CVE-2025-36075",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-11-09T17:11:33.701Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |