What is the CVSS score of CVE-2025-1350?

CVE-2025-1350 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2025-1350?

Yes, a patch is available for CVE-2025-1350. Update the affected software to the latest version immediately.

IBM Controller CVE-2025-1350

EUVD-2025-210933 MEDIUM

Error Message Information Leak (CWE-209)

2026-09-18 ibm

GHSA-55pp-c8pp-j634

Information Disclosure IBM Controller

5.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Remote unauthenticated error-message leak reachable over the network with no interaction; only low confidentiality impact, no integrity or availability effect, matching CWE-209.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 18, 2026 - 15:20 vuln.today

DescriptionCVE.org

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

AnalysisAI

IBM Controller releases 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 can return detailed technical error messages to the browser, allowing remote, unauthenticated attackers to harvest implementation details about the affected system (CWE-209). Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, exploitation is network-reachable and requires no credentials or user interaction, but the impact is confined to low-value information disclosure that is most useful as reconnaissance for follow-on attacks rather than for direct compromise. No public exploit code has been identified and the issue is not listed in CISA KEV, so this is a genuine but low-priority weakness whose practical risk largely depends on whether the Controller web interface is reachable from untrusted networks.

Technical ContextAI

The root cause class is CWE-209, Generation of Error Message Containing Sensitive Information: when IBM Controller's Java-based web application encounters an error condition during request processing, the resulting error page includes verbose technical detail (such as stack traces, internal paths, library versions, or backend/query information) instead of a generic message. Because the application does not sanitize or suppress this diagnostic output before rendering it, any party who can reach the web interface can deliberately provoke malformed or failing requests and read the leaked content. No memory-safety, injection, or authentication-bypass primitive is involved - the vulnerability is an information-exposure defect in error handling, which is why the assessed vector carries only C:L (low confidentiality impact) with I:N and A:N. The CPE cpe:2.3:a:ibm:controller:*:*:*:*:*:*:*:* confirms the affected component is the IBM Controller product itself rather than a shared framework, and the exposed detail is typically useful for fingerprinting the deployment, identifying backend technologies, or refining later attacks.

RemediationAI

Vendor-released patch: patch available per vendor advisory - IBM has published remediation for this issue, so upgrade to the fixed fix-pack level listed in the advisory at https://www.ibm.com/support/pages/node/7287970; because the input data does not enumerate the exact target fix-pack numbers, administrators should read that page to determine the specific build that supersedes 11.0.1 FP7 and 11.1.3 FP1 respectively, and reboot/restart the Controller service after applying it. Where immediate upgrade is not possible, compensating controls should target exposure rather than the error-handling code itself: restrict network access to the Controller web interface with firewall rules or a reverse proxy allowlist so only trusted administrative subnets can reach it, since internal financial-consolidation tooling rarely needs internet exposure and this removes the remote unauthenticated vector entirely (trade-off: legitimate off-network users need VPN access); alternatively, front the application with a proxy that rewrites or blocks verbose error pages, though this is fragile because it depends on pattern-matching the error output and may break legitimate diagnostics; finally, review application logs for repeated requests that trigger server errors, as such probing is the observable signature of exploitation attempts and can be used to detect scanning against the affected endpoints.