Vulnerability-Lookup

CVE-2025-36258 (GCVE-0-2025-36258)

Vulnerability from cvelistv5 – Published: 2026-03-25 20:25 – Updated: 2026-03-26 17:51

Title

IBM InfoSphere Information Server is vulnerable due to plaintext storage of a password

Summary

IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 product stores user credentials and other sensitive information in plain text which can be read by a local user.

Severity ?

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CWE

CWE-256 - Plaintext Storage of a Password

Assigner

ibm

References

URL

Tags

https://www.ibm.com/support/pages/node/7266489

vendor-advisorypatch

Impacted products

	Vendor	Product	Version
	IBM	InfoSphere Information Server	Affected: 11.7.0.0 , ≤ 11.7.1.6 (semver) cpe:2.3:a:ibm:infosphere_information_server:11.7.0.0:::::::* cpe:2.3:a:ibm:infosphere_information_server:11.7.1.6:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-36258",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-26T17:39:47.363797Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-26T17:51:17.281Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:infosphere_information_server:11.7.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:infosphere_information_server:11.7.1.6:*:*:*:*:*:*:*"
          ],
          "product": "InfoSphere Information Server",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "11.7.1.6",
              "status": "affected",
              "version": "11.7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 product stores user credentials and other sensitive information in plain text which can be read by a local user.\u003c/p\u003e"
            }
          ],
          "value": "IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 product stores user credentials and other sensitive information in plain text which can be read by a local user."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-256",
              "description": "CWE-256 Plaintext Storage of a Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-25T20:25:21.329Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7266489"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cbr\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eProduct\u003c/td\u003e\u003ctd\u003eVersion(s)\u003c/td\u003e\u003ctd\u003eAPAR\u003c/td\u003e\u003ctd\u003eRemediation\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM InfoSphere Information Server\u003c/td\u003e\u003ctd\u003e11.7.0.0 to 11.7.1.6\u003c/td\u003e\u003ctd\u003e\u003ca title=\"  DT461542\" href=\"https://www.ibm.com/mysupport/s/defect/aCIgJ0000009sNl/dt461542\" rel=\"nofollow\"\u003eDT461542\u003c/a\u003e\u003c/td\u003e\u003ctd\u003e--Apply IBM InfoSphere Information Server version\u0026nbsp;\u003ca href=\"https://www.ibm.com/support/pages/node/878310\" target=\"_blank\" rel=\"noopener noreferrer nofollow\"\u003e11.7.1.0\u003c/a\u003e\u0026nbsp;\u003cbr\u003e--Apply IBM InfoSphere Information Server version\u0026nbsp;\u003ca href=\"https://www.ibm.com/support/pages/node/7182872\" rel=\"nofollow\"\u003e11.7.1.6\u003c/a\u003e\u003cbr\u003e\u003cbr\u003e--Apply IBM InfoSphere Information Server\u0026nbsp;\u003ca href=\"https://www.ibm.com/support/pages/node/7260779\" rel=\"nofollow\"\u003e11.7.1.6 Service pack 2\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "ProductVersion(s)APARRemediationIBM InfoSphere Information Server11.7.0.0 to 11.7.1.6 DT461542 https://www.ibm.com/mysupport/s/defect/aCIgJ0000009sNl/dt461542 --Apply IBM InfoSphere Information Server version\u00a0 11.7.1.0 https://www.ibm.com/support/pages/node/878310 \u00a0\n--Apply IBM InfoSphere Information Server version\u00a0 11.7.1.6 https://www.ibm.com/support/pages/node/7182872 \n\n--Apply IBM InfoSphere Information Server\u00a0 11.7.1.6 Service pack 2 https://www.ibm.com/support/pages/node/7260779"
        }
      ],
      "title": "IBM InfoSphere Information Server is vulnerable due to plaintext storage of a password",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eWorkarounds and Mitigations On the Microservices tier, change the file permissions: - cd \u0026lt;/INSTALL_PATH/ugdockerfiles\u0026gt; - chmod 0600 uginfo.rsp - chmod 0600 inventory.yaml\u003c/p\u003e"
            }
          ],
          "value": "Workarounds and Mitigations On the Microservices tier, change the file permissions: - cd \u003c/INSTALL_PATH/ugdockerfiles\u003e - chmod 0600 uginfo.rsp - chmod 0600 inventory.yaml"
        }
      ],
      "x_generator": {
        "engine": "ibm-cvegen"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2025-36258",
    "datePublished": "2026-03-25T20:25:21.329Z",
    "dateReserved": "2025-04-15T21:16:44.888Z",
    "dateUpdated": "2026-03-26T17:51:17.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-36258\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2026-03-25T21:16:24.917\",\"lastModified\":\"2026-03-26T18:18:27.973\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 product stores user credentials and other sensitive information in plain text which can be read by a local user.\"},{\"lang\":\"es\",\"value\":\"El producto IBM InfoSphere Information Server 11.7.0.0 hasta 11.7.1.6 almacena credenciales de usuario y otra informaci\u00f3n sensible en texto plano que puede ser le\u00edda por un usuario local.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.5,\"impactScore\":4.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-256\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:infosphere_information_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.7.0.0\",\"versionEndIncluding\":\"11.7.1.6\",\"matchCriteriaId\":\"65FBF88B-61F0-4D42-A290-453FDC874D7F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E492C463-D76E-49B7-A4D4-3B499E422D89\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2572D17-1DE6-457B-99CC-64AFD54487EA\"}]}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7266489\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-36258\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-26T17:39:47.363797Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-26T17:49:37.684Z\"}}], \"cna\": {\"title\": \"IBM InfoSphere Information Server is vulnerable due to plaintext storage of a password\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:infosphere_information_server:11.7.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:infosphere_information_server:11.7.1.6:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"InfoSphere Information Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.7.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"11.7.1.6\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"ProductVersion(s)APARRemediationIBM InfoSphere Information Server11.7.0.0 to 11.7.1.6 DT461542 https://www.ibm.com/mysupport/s/defect/aCIgJ0000009sNl/dt461542 --Apply IBM InfoSphere Information Server version\\u00a0 11.7.1.0 https://www.ibm.com/support/pages/node/878310 \\u00a0\\n--Apply IBM InfoSphere Information Server version\\u00a0 11.7.1.6 https://www.ibm.com/support/pages/node/7182872 \\n\\n--Apply IBM InfoSphere Information Server\\u00a0 11.7.1.6 Service pack 2 https://www.ibm.com/support/pages/node/7260779\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003e\u003cbr\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eProduct\u003c/td\u003e\u003ctd\u003eVersion(s)\u003c/td\u003e\u003ctd\u003eAPAR\u003c/td\u003e\u003ctd\u003eRemediation\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM InfoSphere Information Server\u003c/td\u003e\u003ctd\u003e11.7.0.0 to 11.7.1.6\u003c/td\u003e\u003ctd\u003e\u003ca title=\\\"  DT461542\\\" href=\\\"https://www.ibm.com/mysupport/s/defect/aCIgJ0000009sNl/dt461542\\\" rel=\\\"nofollow\\\"\u003eDT461542\u003c/a\u003e\u003c/td\u003e\u003ctd\u003e--Apply IBM InfoSphere Information Server version\u0026nbsp;\u003ca href=\\\"https://www.ibm.com/support/pages/node/878310\\\" target=\\\"_blank\\\" rel=\\\"noopener noreferrer nofollow\\\"\u003e11.7.1.0\u003c/a\u003e\u0026nbsp;\u003cbr\u003e--Apply IBM InfoSphere Information Server version\u0026nbsp;\u003ca href=\\\"https://www.ibm.com/support/pages/node/7182872\\\" rel=\\\"nofollow\\\"\u003e11.7.1.6\u003c/a\u003e\u003cbr\u003e\u003cbr\u003e--Apply IBM InfoSphere Information Server\u0026nbsp;\u003ca href=\\\"https://www.ibm.com/support/pages/node/7260779\\\" rel=\\\"nofollow\\\"\u003e11.7.1.6 Service pack 2\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7266489\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Workarounds and Mitigations On the Microservices tier, change the file permissions: - cd \u003c/INSTALL_PATH/ugdockerfiles\u003e - chmod 0600 uginfo.rsp - chmod 0600 inventory.yaml\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eWorkarounds and Mitigations On the Microservices tier, change the file permissions: - cd \u0026lt;/INSTALL_PATH/ugdockerfiles\u0026gt; - chmod 0600 uginfo.rsp - chmod 0600 inventory.yaml\u003c/p\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"ibm-cvegen\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 product stores user credentials and other sensitive information in plain text which can be read by a local user.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 product stores user credentials and other sensitive information in plain text which can be read by a local user.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-256\", \"description\": \"CWE-256 Plaintext Storage of a Password\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2026-03-25T20:25:21.329Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-36258\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-26T17:51:17.281Z\", \"dateReserved\": \"2025-04-15T21:16:44.888Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2026-03-25T20:25:21.329Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-PPQH-5G92-F826

Vulnerability from github – Published: 2026-03-25 21:30 – Updated: 2026-03-25 21:30

Details

IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 product stores user credentials and other sensitive information in plain text which can be read by a local user.

Severity ?

7.1 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-36258"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-256"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-25T21:16:24Z",
    "severity": "HIGH"
  },
  "details": "IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 product stores user credentials and other sensitive information in plain text which can be read by a local user.",
  "id": "GHSA-ppqh-5g92-f826",
  "modified": "2026-03-25T21:30:36Z",
  "published": "2026-03-25T21:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36258"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7266489"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

FKIE_CVE-2025-36258

Vulnerability from fkie_nvd - Published: 2026-03-25 21:16 - Updated: 2026-03-26 18:18

Severity ?

7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 product stores user credentials and other sensitive information in plain text which can be read by a local user.

References

	URL	Tags
	psirt@us.ibm.com	https://www.ibm.com/support/pages/node/7266489	Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	infosphere_information_server	*
ibm	aix	-
linux	linux_kernel	-
microsoft	windows	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:infosphere_information_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "65FBF88B-61F0-4D42-A290-453FDC874D7F",
              "versionEndIncluding": "11.7.1.6",
              "versionStartIncluding": "11.7.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E492C463-D76E-49B7-A4D4-3B499E422D89",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 product stores user credentials and other sensitive information in plain text which can be read by a local user."
    },
    {
      "lang": "es",
      "value": "El producto IBM InfoSphere Information Server 11.7.0.0 hasta 11.7.1.6 almacena credenciales de usuario y otra informaci\u00f3n sensible en texto plano que puede ser le\u00edda por un usuario local."
    }
  ],
  "id": "CVE-2025-36258",
  "lastModified": "2026-03-26T18:18:27.973",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 4.0,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-03-25T21:16:24.917",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7266489"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-256"
        }
      ],
      "source": "psirt@us.ibm.com",
      "type": "Primary"
    }
  ]
}

WID-SEC-W-2026-0851

Vulnerability from csaf_certbund - Published: 2026-03-24 23:00 - Updated: 2026-03-25 23:00

Summary

IBM InfoSphere Information Server: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: IBM InfoSphere Information Server ist eine Softwareplattform zur Integration heterogener Daten.

Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial of Service zu verursachen, einen Cross Site Scripting und CSRF Angriff durchzuführen, Informationen offenzulegen und Daten zu manipulieren.

Betroffene Betriebssysteme: - Linux - UNIX - Windows

CVE-2025-14790

CVE-2025-14808

CVE-2025-14810

CVE-2025-14912

CVE-2025-14974

CVE-2025-36258

CVE-2025-36422

CVE-2026-1014

CVE-2026-1015

CVE-2026-1262

CVE-2026-24400

CVE-2026-2483

CVE-2026-2484

CVE-2026-2485

References

URL

Category

	https://wid.cert-bund.de/.well-known/csaf/white/2…	self
	https://wid.cert-bund.de/portal/wid/securityadvis…	self
	https://www.ibm.com/support/pages/node/7266489	external
	https://www.ibm.com/support/pages/node/7266685	external
	https://www.ibm.com/support/pages/node/7266688	external
	https://www.ibm.com/support/pages/node/7266695	external
	https://www.ibm.com/support/pages/node/7266696	external
	https://www.ibm.com/support/pages/node/7266698	external
	https://www.ibm.com/support/pages/node/7266723	external
	https://www.ibm.com/support/pages/node/7266736	external
	https://www.ibm.com/support/pages/node/7266740	external
	https://www.ibm.com/support/pages/node/7266748	external
	https://www.ibm.com/support/pages/node/7266761	external
	https://www.ibm.com/support/pages/node/7266764	external
	https://www.ibm.com/support/pages/node/7266765	external
	https://www.ibm.com/support/pages/node/7266767	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "IBM InfoSphere Information Server ist eine Softwareplattform zur Integration heterogener Daten.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, einen Denial of Service zu verursachen, einen Cross Site Scripting und CSRF Angriff durchzuf\u00fchren, Informationen offenzulegen und Daten zu manipulieren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0851 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0851.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0851 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0851"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-24",
        "url": "https://www.ibm.com/support/pages/node/7266489"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-24",
        "url": "https://www.ibm.com/support/pages/node/7266685"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-24",
        "url": "https://www.ibm.com/support/pages/node/7266688"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-24",
        "url": "https://www.ibm.com/support/pages/node/7266695"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-24",
        "url": "https://www.ibm.com/support/pages/node/7266696"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-24",
        "url": "https://www.ibm.com/support/pages/node/7266698"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-24",
        "url": "https://www.ibm.com/support/pages/node/7266723"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-24",
        "url": "https://www.ibm.com/support/pages/node/7266736"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-24",
        "url": "https://www.ibm.com/support/pages/node/7266740"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-24",
        "url": "https://www.ibm.com/support/pages/node/7266748"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-24",
        "url": "https://www.ibm.com/support/pages/node/7266761"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-24",
        "url": "https://www.ibm.com/support/pages/node/7266764"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-24",
        "url": "https://www.ibm.com/support/pages/node/7266765"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-24",
        "url": "https://www.ibm.com/support/pages/node/7266767"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM InfoSphere Information Server: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-03-25T23:00:00.000+00:00",
      "generator": {
        "date": "2026-03-26T07:56:10.924+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0851",
      "initial_release_date": "2026-03-24T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-03-24T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-03-25T23:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2025-209025, EUVD-2025-209023, EUVD-2025-209022, EUVD-2026-15980, EUVD-2025-209019, EUVD-2025-209018, EUVD-2025-209016, EUVD-2025-209010, EUVD-2026-15978, EUVD-2026-15976"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.7.0.0-11.7.1.6",
                "product": {
                  "name": "IBM InfoSphere Information Server 11.7.0.0-11.7.1.6",
                  "product_id": "T048277",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:infosphere_information_server:11.7.0.0_to_11.7.1.6"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "InfoSphere Information Server"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14790",
      "product_status": {
        "known_affected": [
          "T048277"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2025-14790"
    },
    {
      "cve": "CVE-2025-14808",
      "product_status": {
        "known_affected": [
          "T048277"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2025-14808"
    },
    {
      "cve": "CVE-2025-14810",
      "product_status": {
        "known_affected": [
          "T048277"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2025-14810"
    },
    {
      "cve": "CVE-2025-14912",
      "product_status": {
        "known_affected": [
          "T048277"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2025-14912"
    },
    {
      "cve": "CVE-2025-14974",
      "product_status": {
        "known_affected": [
          "T048277"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2025-14974"
    },
    {
      "cve": "CVE-2025-36258",
      "product_status": {
        "known_affected": [
          "T048277"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2025-36258"
    },
    {
      "cve": "CVE-2025-36422",
      "product_status": {
        "known_affected": [
          "T048277"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2025-36422"
    },
    {
      "cve": "CVE-2026-1014",
      "product_status": {
        "known_affected": [
          "T048277"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-1014"
    },
    {
      "cve": "CVE-2026-1015",
      "product_status": {
        "known_affected": [
          "T048277"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-1015"
    },
    {
      "cve": "CVE-2026-1262",
      "product_status": {
        "known_affected": [
          "T048277"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-1262"
    },
    {
      "cve": "CVE-2026-24400",
      "product_status": {
        "known_affected": [
          "T048277"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-24400"
    },
    {
      "cve": "CVE-2026-2483",
      "product_status": {
        "known_affected": [
          "T048277"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-2483"
    },
    {
      "cve": "CVE-2026-2484",
      "product_status": {
        "known_affected": [
          "T048277"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-2484"
    },
    {
      "cve": "CVE-2026-2485",
      "product_status": {
        "known_affected": [
          "T048277"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-2485"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-36258 (GCVE-0-2025-36258)

GHSA-PPQH-5G92-F826

FKIE_CVE-2025-36258

WID-SEC-W-2026-0851

Tags

Sightings

Nomenclature