Sterling Partner Engagement Manager CVE-2025-13723

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates a network-exploitable vulnerability with low attack complexity and no privilege requirements, scoring 5.3 (Medium). However, several factors moderate real-world risk: the impact scope is strictly confidentiality (C:L) with no integrity or availability impact, limiting the severity; exploitation requires either possession of or knowledge of a valid expired token, reducing the attack surface compared to zero-day authentication bypasses; and the vulnerability affects only specific patch levels (6.2.3.0-6.2.3.5 and 6.2.4.0-6.2.4.2), suggesting newer versions may contain fixes. Without confirmed EPSS scoring, KEV (CISA Known Exploited Vulnerabilities) designation, or public proof-of-concept availability reported, the risk appears to be theoretical rather than actively weaponized. Organizations with Sterling PEM deployments should prioritize patching, but this is not an emergency-level zero-day; it represents a moderate configuration/implementation flaw requiring standard patch management cycles.

An attacker obtains or intercepts a valid access token from a Sterling PEM user (e.g., via network sniffing, memory dump, or social engineering). After the token expires on the user's client, the attacker replays the same token in API requests to Sterling PEM's user information endpoints; due to insufficient token expiration validation, the server accepts the request and returns sensitive user data (names, email addresses, contact information, account details) without re-authenticating. This is particularly dangerous in B2B scenarios where Sterling PEM integrates multiple partner organizations, as compromised tokens could expose cross-partner business intelligence and user directories.