IBM DevOps Deploy CVE-2025-13489

Exploitation requires the attacker to actively intercept or sit in the network path (man-in-the-middle) between IBM DevOps Deploy (formerly UrbanCode Deploy) components in versions 8.1 through 8.1.2.3, because the product transmits data over a channel that is not encrypted (CWE-319). The primary limiting factors are: (1) the need to achieve and maintain a privileged MITM position, which drives the high attack complexity (AC:H); and (2) the exposure being confidentiality-only - no data modification or availability impact. No authentication and no user interaction are required (PR:N/UI:N per the provided vector), but environments that already tunnel this traffic over an enforced TLS/VPN layer would substantially reduce real-world exposure.

This is a moderate-severity information-disclosure issue (CVSS 5.9, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) whose signals consistently point to a lower-priority, hard-to-exploit flaw rather than an urgent threat. The attack vector is network and no privileges or user interaction are required (PR:N/UI:N), but the high attack complexity (AC:H) reflects the core limiting factor: the attacker must already occupy a privileged man-in-the-middle position on the network path between a DevOps Deploy client and server, which is not trivially achievable. The confidentiality-only impact (C:H, I:N, A:N) is consistent with CWE-319 (cleartext transmission). Corroborating this low urgency, EPSS is 0.19% (8th percentile), the vulnerability is NOT on the CISA KEV list, and no public exploit code was identified. There is no conflict among the signals - CVSS, EPSS, and KEV all agree this is a real but low-probability, condition-dependent exposure. The one soft point is the vendor description's vagueness about exactly what 'sensitive information' is exposed; the C:H rating is plausible if credentials or deployment artifacts traverse the channel, but this should be verified against the IBM advisory (node/7254662).

An attacker positioned on the network path (e.g., on a shared corporate LAN segment or compromised router) between an IBM DevOps Deploy agent/client and the server passively intercepts traffic that is transmitted in clear text, extracting sensitive information such as deployment data or credentials. No public exploit code is known, and success depends on the attacker first achieving a man-in-the-middle vantage point, consistent with the high attack complexity.