EUVD-2025-210934
GHSA-8m5f-wwr2-p32r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Remote unauthenticated low-complexity abuse of missing frequency control degrades only the email service, so A:L with C:N/I:N and no scope change.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM Sterling Partner Engagement Manager Standard Edition 6.2.4.0 through 6.2.4.4 could allow an unauthenticated user to cause a denial of service in the email service due to improper control of interaction frequency.
AnalysisAI
Unauthenticated remote attackers can degrade the email service of IBM Sterling Partner Engagement Manager (PEM) by flooding it with requests, exploiting improper control of interaction frequency (CWE-799) so the service is unable to keep up with legitimate mail processing. The affected releases are Essentials Edition 6.3.0.0 through 6.3.0.2 and 6.2.4.0 through 6.2.4.4, plus Standard Edition 6.2.4.0 through 6.2.4.4; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 Medium), no authentication or user interaction is required against a default configuration when the email service is network-reachable. Impact is limited to partial availability loss (A:L) with no confidentiality or integrity effect and no scope change, so this is a service-degradation weakness rather than a full application outage; no public exploit code has been identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis.
Technical ContextAI
The root cause class is CWE-799, Improper Control of Interaction Frequency, which means the application fails to throttle or rate-limit how often a caller may invoke a given interaction. In IBM Sterling PEM the affected component is the email service, which handles outbound or notification mail generation and delivery; because the endpoint accepts requests over the network without requiring authentication (CVSS PR:N/UI:N) and without rate limiting or back-pressure, an attacker can issue repeated requests and consume the email service's processing or connection capacity. The CPE data confirms the affected packages are ibm:sterling_partner_engagement_manager_essentials_edition and ibm:sterling_partner_engagement_manager_standard_edition, both commercial partner-engagement platforms used for onboarding, collaboration, and notification workflows. Because the CVSS vector has S:U (scope unchanged) and only A:L, the weakness stays within the email service and degrades rather than destroys availability, which is consistent with a rate-limiting/flood defect rather than a memory-corruption, injection, or authentication-bypass issue. The attack surface is the PEM email service whenever it is exposed beyond a trusted network segment.
RemediationAI
Apply the fix from the vendor advisory at https://www.ibm.com/support/pages/node/7288365, which is listed as a patch reference for this issue; patch availability is confirmed but no specific fixed build number is given in the supplied data, so confirm with IBM's support note which 6.3.0.x or 6.2.4.x level contains the correction before upgrading. If immediate patching is not possible, reduce exposure of the PEM email service: restrict network reachability so only trusted application hosts, mail relays, or administrative subnets can reach the service, and place an authenticated reverse proxy or load balancer in front of it that enforces per-source request rate limits and connection caps - the trade-off is that legitimate bulk notifications may need to be re-pointed through the proxy or throttled to match the new limits. Enforce SMTP/notification throttling at the mail gateway by capping messages per sender and per recipient domain and by queuing or deferring excess traffic, which protects the downstream mail system but can delay time-sensitive partner onboarding emails. Because the CVSS vector shows CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, do not expect confidentiality or integrity protections to mitigate this issue; availability controls (rate limiting, network segmentation, monitoring for repeated requests to the email service) are the effective compensating controls until the vendor patch is installed.
Same weakness CWE-799 – Improper Control of Interaction Frequency
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today