EUVD-2025-209253
GHSA-32vv-mwc8-ch6p
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from Vendor (ibm) · only source for this CVE.
CVSS VectorVendor: ibm
Lifecycle Timeline
4DescriptionCVE.org
IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.
AnalysisAI
IBM Concert versions 1.0.0 through 2.2.0 create temporary files with predictable names, allowing local unauthenticated attackers to overwrite arbitrary files through symlink attacks. An attacker with local system access can exploit this insecure temporary file handling to modify critical application or system files, achieving high integrity impact. No public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
This vulnerability stems from inadequate temporary file creation practices, classified under CWE-340 (Generation of Predictable Numbers or Identifiers). When IBM Concert generates temporary files during operation, it uses predictable naming schemes without proper protections against symlink attacks. A local attacker can predict the temporary file path, create a symbolic link to a target file in advance, and when the application writes to the predictable temporary file location, the symlink causes the actual write operation to target an arbitrary file the attacker specifies. This is a classic TOCTOU (time-of-check-time-of-use) variant affecting local file operations. The affected product is IBM Concert, a collaboration and integration platform, across all versions from 1.0.0 through 2.2.0 (CPE: cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*).
RemediationAI
Upgrade IBM Concert to the patched version released by IBM. Organizations should consult the vendor advisory at https://www.ibm.com/support/pages/node/7268620 for the specific fixed release version applicable to their deployment. As an interim mitigation, restrict local system access to IBM Concert installation and temporary file directories to trusted users only, and monitor file system activity for suspicious symlink creation in temporary directories. Ensure the host operating system enforces secure temporary file creation protections if available (e.g., restrictive umask, secure tmpdir implementations).
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8)
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Rated
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statem
Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions
Concert versions up to 2.1.0 is affected by incorrect permission assignment for critical resource (CVSS 7.4).
IBM Concert Software 1.0.0 through 1.0.5 could allow an authenticated user to cause a denial of service due to the expan
IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF). Rated medium severity (CVS
Concert versions up to 2.1.0 contains a vulnerability that allows attackers to conduct various attacks against the vulne
IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information or perform unauthorized ac
IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery which could allow an att
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to obtain sensitive information
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today