IBM DOORS CVE-2025-0152

The attacker requires no authentication - CVSS PR:N confirms the XSS payload can be delivered without any credentials against the DOORS Web Access web interface. User interaction is mandatory (CVSS UI:R): a legitimate, authenticated DOORS user must click an attacker-crafted link or visit a page that triggers the XSS payload while holding an active session. The victim must be running an active authenticated DOORS Web Access session for credential or session-token disclosure to occur. No non-default configuration is required - the vulnerability affects the standard DOORS Web Access web UI in the vulnerable version ranges. The primary limiting factor is the social engineering dependency: automated mass exploitation is constrained by the UI:R requirement, making this most relevant in targeted attacks against known DOORS user communities such as aerospace or defense contractors.

The CVSS 3.1 base score of 6.1 (Medium) reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) attack that nonetheless requires user interaction (UI:R). The scope change (S:C) elevates the score by recognizing that exploit impact crosses into the victim's browser session. In practical terms, this is a classic reflected or stored XSS targeting an authenticated DOORS user: the attacker bears no authentication burden, but must socially engineer a victim to trigger the payload. The credential-disclosure impact (C:L, I:L) is meaningful in a requirements management context where DOORS sessions may have access to sensitive engineering artifacts. No EPSS data was provided, no CISA KEV listing exists, and no public POC has been identified - these signals together suggest opportunistic or targeted risk rather than broad automated exploitation. The primary risk is phishing or watering-hole scenarios against DOORS users in defense or aerospace supply chains, where session credential theft could yield access to controlled technical documentation.

An attacker crafts a malicious URL targeting the DOORS Web Access interface with an embedded JavaScript payload and delivers it to an authenticated DOORS user via phishing email or a watering-hole site. When the victim clicks the link and their browser renders the vulnerable page, the injected script executes within the authenticated session, silently exfiltrating session cookies or credentials to an attacker-controlled endpoint. No public POC code has been identified, but the low-complexity, no-authentication-required nature of the attack makes independent reproduction straightforward for a skilled attacker.