Vulnerability-Lookup

CVE-2025-36354 (GCVE-0-2025-36354)

Vulnerability from cvelistv5 – Published: 2025-10-06 16:53 – Updated: 2025-10-06 19:58

Title

IBM Security Verify Access command execution

Summary

IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system due to improper validation of user supplied input.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-06 19:58 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

ibm CNA under the mitre root

CNA scorecard B 88/100 over 1289 records in the last 180 days details

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7247215	vendor-advisorypatch

Impacted products

2 products

Vendor	Product	Version	CPE status
IBM	Security Verify Access Appliance	Affected: 10.0.0.0 , ≤ 10.0.9.0 IF2 (semver) Affected: 11.0.0.0 , ≤ 11.0.1.0 (semver) cpe:2.3:a:ibm:security_verify_access:10.0.0.0:::::::* cpe:2.3:a:ibm:security_verify_access:10.0.9.0:interm_fix2:::::: cpe:2.3:a:ibm:security_verify_access:11.0.0.0:::::::* cpe:2.3:a:ibm:security_verify_access:11.0.1.0:::::::*
IBM	Security Verify Access Docker	Affected: 10.0.0.0 , ≤ 10.0.9.0 IF2 (semver) Affected: 11.0.0.0 , ≤ 11.0.1.0 (semver) cpe:2.3:a:ibm:security_verify_access_docker:10.0.0.0:::::::* cpe:2.3:a:ibm:security_verify_access_docker:10.0.9.0:interm_fix2:::::: cpe:2.3:a:ibm:security_verify_access_docker:11.0.0.0:::::::* cpe:2.3:a:ibm:security_verify_access_docker:11.0.1.0:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-36354",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-06T19:58:30.805460Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-06T19:58:39.023Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:security_verify_access:10.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access:10.0.9.0:interm_fix2:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access:11.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access:11.0.1.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Security Verify Access Appliance",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "10.0.9.0 IF2",
              "status": "affected",
              "version": "10.0.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "11.0.1.0",
              "status": "affected",
              "version": "11.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:security_verify_access_docker:10.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access_docker:10.0.9.0:interm_fix2:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access_docker:11.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access_docker:11.0.1.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Security Verify Access Docker",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "10.0.9.0 IF2",
              "status": "affected",
              "version": "10.0.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "11.0.1.0",
              "status": "affected",
              "version": "11.0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ecould allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system due to improper validation of user supplied input.\u003c/span\u003e\n\n\u003c/span\u003e"
            }
          ],
          "value": "IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 \n\n\n\ncould allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system due to improper validation of user supplied input."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-06T16:53:43.179Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7247215"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Security Verify Access command execution",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2025-36354",
    "datePublished": "2025-10-06T16:53:43.179Z",
    "dateReserved": "2025-04-15T21:16:54.209Z",
    "dateUpdated": "2025-10-06T19:58:39.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-36354",
      "date": "2026-10-26",
      "epss": "0.00333",
      "percentile": "0.26465"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:ibm:security_verify_access:10.0.0.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:ibm:security_verify_access:10.0.9.0:interm_fix2:*:*:*:*:*:*",
                  "cpe:2.3:a:ibm:security_verify_access:11.0.0.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:ibm:security_verify_access:11.0.1.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "Security Verify Access Appliance",
                "vendor": "IBM",
                "versions": [
                  {
                    "lessThanOrEqual": "10.0.9.0 IF2",
                    "status": "affected",
                    "version": "10.0.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "11.0.1.0",
                    "status": "affected",
                    "version": "11.0.0.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:ibm:security_verify_access_docker:10.0.0.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:ibm:security_verify_access_docker:10.0.9.0:interm_fix2:*:*:*:*:*:*",
                  "cpe:2.3:a:ibm:security_verify_access_docker:11.0.0.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:ibm:security_verify_access_docker:11.0.1.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "Security Verify Access Docker",
                "vendor": "IBM",
                "versions": [
                  {
                    "lessThanOrEqual": "10.0.9.0 IF2",
                    "status": "affected",
                    "version": "10.0.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "11.0.1.0",
                    "status": "affected",
                    "version": "11.0.0.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "psirt@us.ibm.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ibm:security_verify_access:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CCA4ADF8-014B-4A43-AE12-CC7D46B0F8BF",
                    "versionEndExcluding": "10.0.9.0",
                    "versionStartIncluding": "10.0.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.9.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "9916DF0F-8A3E-4CB4-957F-286E168666A2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.9.0:interim_fix1:*:*:*:*:*:*",
                    "matchCriteriaId": "05FBA01C-DDCD-4B80-B14B-81DAB052CC8D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.9.0:interim_fix2:*:*:*:*:*:*",
                    "matchCriteriaId": "149CA168-1117-4B50-8F5A-B72D4BCC65F1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:security_verify_access_docker:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FFF4D7D4-0D01-44CA-84A2-2EA59802D1CB",
                    "versionEndExcluding": "10.0.9.0",
                    "versionStartIncluding": "10.0.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:security_verify_access_docker:10.0.9.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "7E76C6CF-1E2A-403E-9C7F-619BE2057468",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:security_verify_access_docker:10.0.9.0:interim_fix1:*:*:*:*:*:*",
                    "matchCriteriaId": "B8BF3374-6B03-4A25-9F4D-F88C091804C7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:security_verify_access_docker:10.0.9.0:interim_fix2:*:*:*:*:*:*",
                    "matchCriteriaId": "C8D09601-F55B-4307-8BEE-218F5CAC2138",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ibm:verify_identity_access:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "16595130-3A46-4DD1-9DAA-53E534306975",
                    "versionEndExcluding": "11.0.1.0",
                    "versionStartIncluding": "11.0.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:verify_identity_access:11.0.1.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "4A7A934C-F8B6-44D1-9591-A3FDB86BEECB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:verify_identity_access_docker:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "81BD4D96-C9E9-422B-B18A-61ECFE711884",
                    "versionEndExcluding": "11.0.1.0",
                    "versionStartIncluding": "11.0.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ibm:verify_identity_access_docker:11.0.1.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "0C06D5AD-67DD-46FA-BDF7-39A2E0EAAF95",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 \n\n\n\ncould allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system due to improper validation of user supplied input."
          },
          {
            "lang": "es",
            "value": "IBM Security Verify Access y IBM Security Verify Access Docker 10.0.0.0 hasta 10.0.9.0 y 11.0.0.0 hasta 11.0.1.0 podr\u00edan permitir a un usuario no autenticado ejecutar comandos arbitrarios con privilegios de usuario m\u00e1s bajos en el sistema debido a una validaci\u00f3n incorrecta de la entrada proporcionada por el usuario."
          }
        ],
        "id": "CVE-2025-36354",
        "lastModified": "2026-10-18T21:10:00.120",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.4,
              "source": "psirt@us.ibm.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-36354",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-06T19:58:30.805460Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-06T17:16:05.127",
        "references": [
          {
            "source": "psirt@us.ibm.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://www.ibm.com/support/pages/node/7247215"
          }
        ],
        "sourceIdentifier": "psirt@us.ibm.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-78"
              }
            ],
            "source": "psirt@us.ibm.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-10-07T17:35:27+00:00",
      "cve": "CVE-2025-36354",
      "id": "CVE-2025-36354",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "IBM Security Verify Access command execution",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-36354.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-36354",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-06T19:58:30.805460Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-06T19:58:35.947Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:ibm:security_verify_access:10.0.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:ibm:security_verify_access:10.0.9.0:interm_fix2:*:*:*:*:*:*",
                "cpe:2.3:a:ibm:security_verify_access:11.0.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:ibm:security_verify_access:11.0.1.0:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "Security Verify Access Appliance",
              "vendor": "IBM",
              "versions": [
                {
                  "lessThanOrEqual": "10.0.9.0 IF2",
                  "status": "affected",
                  "version": "10.0.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.0.1.0",
                  "status": "affected",
                  "version": "11.0.0.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "cpes": [
                "cpe:2.3:a:ibm:security_verify_access_docker:10.0.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:ibm:security_verify_access_docker:10.0.9.0:interm_fix2:*:*:*:*:*:*",
                "cpe:2.3:a:ibm:security_verify_access_docker:11.0.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:ibm:security_verify_access_docker:11.0.1.0:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "Security Verify Access Docker",
              "vendor": "IBM",
              "versions": [
                {
                  "lessThanOrEqual": "10.0.9.0 IF2",
                  "status": "affected",
                  "version": "10.0.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.0.1.0",
                  "status": "affected",
                  "version": "11.0.0.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ecould allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system due to improper validation of user supplied input.\u003c/span\u003e\n\n\u003c/span\u003e"
                }
              ],
              "value": "IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 \n\n\n\ncould allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system due to improper validation of user supplied input."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-78",
                  "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-10-06T16:53:43.179Z",
            "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
            "shortName": "ibm"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory",
                "patch"
              ],
              "url": "https://www.ibm.com/support/pages/node/7247215"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "IBM Security Verify Access command execution",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "assignerShortName": "ibm",
        "cveId": "CVE-2025-36354",
        "datePublished": "2025-10-06T16:53:43.179Z",
        "dateReserved": "2025-04-15T21:16:54.209Z",
        "dateUpdated": "2025-10-06T19:58:39.023Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2025-13672 (CVE-2025-36354)

Vulnerability from fstec – Published: 2025-11-02 – Updated: 2025-11-02 – View on bdu.fstec.ru Fixed

Title

Уязвимость системы управления доступом IBM Verify Identity Access (ранее IBM Security Verify Access), связанная с непринятием мер по нейтрализации специальных элементов, позволяющая нарушителю выполнить произвольные команды

Summary

Уязвимость системы управления доступом IBM Verify Identity Access (ранее IBM Security Verify Access) связана с непринятием мер по нейтрализации специальных элементов. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольные команды

Severity

7.5 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:P/I:P/A:P

7.3 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Injection

Incidents

Being clarified

Remediation

Software update

CWE

CWE-78 - Непринятие мер по нейтрализации специальных элементов, используемых в команде операционной системы (Внедрение в команду операционной системы)

Aliases

CVE-2025-36354

References

1 reference

URL
https://www.ibm.com/support/pages/node/7247215

Impacted products

2 products from 1 vendor

Vendors

IBM Corp.

Products

IBM Security Verify Access, IBM Verify Identity Access

Versions

от 10.0.0.0 до 10.0.9.0-IF3 (IBM Security Verify Access), от 11.0.0.0 до 11.0.1.0-IF1 (IBM Verify Identity Access)

Product types

Security device, Security software

Mitigations

Использование рекомендаций: https://www.ibm.com/support/pages/node/7247215

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "IBM Corp.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u043e\u0442 10.0.0.0 \u0434\u043e 10.0.9.0-IF3 (IBM Security Verify Access), \u043e\u0442 11.0.0.0 \u0434\u043e 11.0.1.0-IF1 (IBM Verify Identity Access)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://www.ibm.com/support/pages/node/7247215",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "06.10.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "02.11.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "02.11.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-13672",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-36354",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "IBM Security Verify Access, IBM Verify Identity Access",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c IBM Verify Identity Access (\u0440\u0430\u043d\u0435\u0435 IBM Security Verify Access), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435\u043c \u043c\u0435\u0440 \u043f\u043e \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435 \u043c\u0435\u0440 \u043f\u043e \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b (\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b) (CWE-78)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c IBM Verify Identity Access (\u0440\u0430\u043d\u0435\u0435 IBM Security Verify Access) \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435\u043c \u043c\u0435\u0440 \u043f\u043e \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u043d\u044a\u0435\u043a\u0446\u0438\u044f",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.ibm.com/support/pages/node/7247215",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-78",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,3)"
}

FKIE_CVE-2025-36354

Vulnerability from fkie_nvd - Published: 2025-10-06 17:16 - Updated: 2026-10-18 21:10

Severity

7.3 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Summary

References

	URL	Tags
	psirt@us.ibm.com	https://www.ibm.com/support/pages/node/7247215	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	security_verify_access	*
ibm	security_verify_access	10.0.9.0
ibm	security_verify_access	10.0.9.0
ibm	security_verify_access	10.0.9.0
ibm	security_verify_access_docker	*
ibm	security_verify_access_docker	10.0.9.0
ibm	security_verify_access_docker	10.0.9.0
ibm	security_verify_access_docker	10.0.9.0
ibm	verify_identity_access	*
ibm	verify_identity_access	11.0.1.0
ibm	verify_identity_access_docker	*
ibm	verify_identity_access_docker	11.0.1.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:security_verify_access:10.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access:10.0.9.0:interm_fix2:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access:11.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access:11.0.1.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Security Verify Access Appliance",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "10.0.9.0 IF2",
              "status": "affected",
              "version": "10.0.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "11.0.1.0",
              "status": "affected",
              "version": "11.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:security_verify_access_docker:10.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access_docker:10.0.9.0:interm_fix2:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access_docker:11.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access_docker:11.0.1.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Security Verify Access Docker",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "10.0.9.0 IF2",
              "status": "affected",
              "version": "10.0.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "11.0.1.0",
              "status": "affected",
              "version": "11.0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCA4ADF8-014B-4A43-AE12-CC7D46B0F8BF",
              "versionEndExcluding": "10.0.9.0",
              "versionStartIncluding": "10.0.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.9.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "9916DF0F-8A3E-4CB4-957F-286E168666A2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.9.0:interim_fix1:*:*:*:*:*:*",
              "matchCriteriaId": "05FBA01C-DDCD-4B80-B14B-81DAB052CC8D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.9.0:interim_fix2:*:*:*:*:*:*",
              "matchCriteriaId": "149CA168-1117-4B50-8F5A-B72D4BCC65F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access_docker:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFF4D7D4-0D01-44CA-84A2-2EA59802D1CB",
              "versionEndExcluding": "10.0.9.0",
              "versionStartIncluding": "10.0.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access_docker:10.0.9.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "7E76C6CF-1E2A-403E-9C7F-619BE2057468",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access_docker:10.0.9.0:interim_fix1:*:*:*:*:*:*",
              "matchCriteriaId": "B8BF3374-6B03-4A25-9F4D-F88C091804C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access_docker:10.0.9.0:interim_fix2:*:*:*:*:*:*",
              "matchCriteriaId": "C8D09601-F55B-4307-8BEE-218F5CAC2138",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:verify_identity_access:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "16595130-3A46-4DD1-9DAA-53E534306975",
              "versionEndExcluding": "11.0.1.0",
              "versionStartIncluding": "11.0.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:verify_identity_access:11.0.1.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "4A7A934C-F8B6-44D1-9591-A3FDB86BEECB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:verify_identity_access_docker:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "81BD4D96-C9E9-422B-B18A-61ECFE711884",
              "versionEndExcluding": "11.0.1.0",
              "versionStartIncluding": "11.0.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:verify_identity_access_docker:11.0.1.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "0C06D5AD-67DD-46FA-BDF7-39A2E0EAAF95",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 \n\n\n\ncould allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system due to improper validation of user supplied input."
    },
    {
      "lang": "es",
      "value": "IBM Security Verify Access y IBM Security Verify Access Docker 10.0.0.0 hasta 10.0.9.0 y 11.0.0.0 hasta 11.0.1.0 podr\u00edan permitir a un usuario no autenticado ejecutar comandos arbitrarios con privilegios de usuario m\u00e1s bajos en el sistema debido a una validaci\u00f3n incorrecta de la entrada proporcionada por el usuario."
    }
  ],
  "id": "CVE-2025-36354",
  "lastModified": "2026-10-18T21:10:00.120",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.4,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-36354",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-10-06T19:58:30.805460Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-10-06T17:16:05.127",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7247215"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "psirt@us.ibm.com",
      "type": "Secondary"
    }
  ]
}

GHSA-7JJ8-XPMF-FCV4

Vulnerability from github – Published: 2025-10-06 18:31 – Updated: 2025-10-06 18:31

Details

IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0

could allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system due to improper validation of user supplied input.

Severity

7.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-36354"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-06T17:16:05Z",
    "severity": "HIGH"
  },
  "details": "IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 \n\n\n\ncould allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system due to improper validation of user supplied input.",
  "id": "GHSA-7jj8-xpmf-fcv4",
  "modified": "2025-10-06T18:31:06Z",
  "published": "2025-10-06T18:31:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36354"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7247215"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2025-2210

Vulnerability from csaf_certbund - Published: 2025-10-06 22:00 - Updated: 2025-10-06 22:00

Summary

IBM Security Verify Access: Mehrere Schwachstellen

Severity

Hoch

Scope

3 vulnerabilities in this advisory, including CVE-2025-36354.

CVE-2025-36354

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-36354 (GCVE-0-2025-36354)

BDU:2025-13672 (CVE-2025-36354)

FKIE_CVE-2025-36354

GHSA-7JJ8-XPMF-FCV4

WID-SEC-W-2025-2210

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour