InfoSphere Information Server CVE-2025-12832

Requires an authenticated session with at least low-privilege access to IBM InfoSphere Information Server (versions 11.7.0.0 through 11.7.1.6), per the CVSS PR:L metric and the description's 'authenticated attacker' language. The attacker must reach a request-processing feature that accepts attacker-influenced URLs/targets and issues outbound requests on the server's behalf. Limiting factors: valid credentials are mandatory (no unauthenticated exploitation), no user interaction is required, and impact is confined to confidentiality (C:L) - the flaw enables outbound request forgery/network enumeration but does not itself modify data or cause denial of service. The exact vulnerable feature is not named in the provided data.

This is a moderate-severity, low-priority issue in practice. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a network-reachable but authenticated SSRF with only low confidentiality impact and no integrity or availability impact - consistent with the description's stated outcome of 'network enumeration or facilitating other attacks' rather than direct data compromise. The EPSS score of 0.07% (22nd percentile) indicates very low expected exploitation probability, and there is no CISA KEV listing and no public exploit identified, so all three threat signals (CVSS, EPSS, exploitation status) agree that this is NOT a widespread or urgent exploitation risk. The PR:L requirement meaningfully limits exposure because an attacker must already hold valid low-privilege credentials on the InfoSphere system. No SSVC data was provided in the input. The main residual risk is as a secondary/pivot primitive inside an already-breached environment, not as an initial access vector; signals are internally consistent with no conflicts to flag.

An attacker who already possesses valid low-privilege credentials to InfoSphere Information Server abuses a request-handling feature to coerce the server into making attacker-controlled outbound requests. They use this to probe internal network ranges and services that are not directly reachable from their position, mapping the environment to stage follow-on attacks. No public exploit code is identified at time of analysis.