Db2 Intelligence Center
CVE-2025-14687
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryIntercept client-server traffic with proxy
-
ExploitCraft request bypassing client-side control
-
ExecutionServer executes unauthorized action
-
ImpactIntegrity of data/config altered
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Server-side security enforcement
|
| Exploitation Conditions | Requires valid authenticated access to IBM Db2 Intelligence Center (versions 1.1.0, 1.1.1, or 1.1.2) as a low-privileged user (PR:L); the attacker must be able to send requests directly to the server, bypassing the client-side enforcement, typically via an intercepting proxy or crafted API calls. Limiting factors: exploitation is confined to actions the server will accept once client-side checks are circumvented, impact is integrity-only (no data disclosure or denial of service per C:N/A:N), and a legitimate account on the application is mandatory, which narrows the attacker population to insiders or those who have otherwise obtained credentials. |
| Impact | This is a moderate-risk, authenticated authorization-bypass issue rather than a critical remote threat. The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5) describes a network-reachable, low-complexity flaw that requires an already-authenticated low-privileged user (PR:L) and yields integrity impact only (I:H) with no confidentiality or availability loss. CWE-602 (client-side enforcement of server-side security) means security controls are enforced in the client; an attacker who manipulates the client or crafts direct API requests can bypass them to perform actions the UI would normally forbid. EPSS is low at 0.21% (10th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so this is best treated as a routine patch-cycle item, not an emergency. The signals are internally consistent - low EPSS, no KEV, no POC, and a mid-range CVSS all point to limited real-world urgency. Note the single reference is IBM's own advisory; affected-version and impact details rest on vendor self-reporting and have not been independently corroborated. |
| Exploit ScenarioDerived | A legitimate low-privileged Db2 Intelligence Center user intercepts or replays application traffic (e.g., via a proxy) and issues server requests directly, skipping the client-side checks that are supposed to gate restricted operations. Because enforcement lives in the client, the server honors the request, letting the user modify data or perform actions beyond their authorization. No public exploit code is known, but the attack requires only standard tooling and valid credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Authenticated low-privileged users of IBM Db2 Intelligence Center 1.1.0, 1.1.1, and 1.1.2 can perform unauthorized server-side actions by circumventing security checks that are enforced only in the client, allowing integrity-impacting operations the user should not be permitted to run. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning it requires a valid account, yields no data disclosure or denial of service, but can corrupt or alter state; there is no public exploit identified at time of analysis and EPSS is low at 0.21% (10th percentile). This is best characterized as a moderate-risk authorization-bypass issue affecting authenticated insiders or credential-holders rather than an unauthenticated remote threat.
RemediationAI
No vendor patch version is confirmed in the provided data; the primary action is to open IBM's advisory at https://www.ibm.com/support/pages/node/7255160 and apply the fix level IBM specifies for Db2 Intelligence Center 1.1.0, 1.1.1, or 1.1.2, upgrading to the first non-vulnerable build as soon as it is published. Until that patch is applied, compensation must target the missing server-side check: because the weakness is CWE-602, the durable workaround is to enforce authorization on the backend API layer rather than the UI, which typically requires vendor configuration or code changes and may restrict legitimate UI-driven workflows if applied bluntly. Practical interim controls include restricting network reachability of the Intelligence Center endpoints to trusted internal segments or a VPN (reduces exposure but does not stop a malicious insider who already has a session), tightening and reviewing which accounts hold low-privilege access so the attacker population is minimized (impacts legitimate user onboarding), and instrumenting/monitoring backend API logs for requests that perform privileged operations from low-privileged sessions so that interception-proxy abuse is detected. Note that these controls lower risk but cannot fully substitute for server-side enforcement, since any valid user can still replay or craft requests; also note there is no public exploit code identified, so prioritization should follow normal authenticated integrity-bypass severity rather than emergency patching.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-602, Client-Side Enforcement of Server-Side Security. In this pattern the application's web front end or API client applies the access-control/validation logic, while the backend service does not independently re-check the same authorization decisions when handling the underlying requests. Because enforcement lives in the browser/UI layer, an attacker with a legitimate session can bypass it with an intercepting proxy or by crafting API calls directly to the server, and the server will accept operations it should have rejected. The affected technology is IBM Db2 Intelligence Center, a browser-accessed analytics/governance front end for Db2 data estates, identified in the CPE data as cpe:2.3:a:ibm:db2_intelligence_center:*:*:*:*:*:*:*:* (no platform qualifiers, i.e., the application itself regardless of deployment OS). The CVSS vector confirms the network attack surface (AV:N), no user interaction (UI:N), low privileges required (PR:L), and an integrity-only impact (C:N/I:H/A:N) with unchanged scope, so the practical exposure is limited to actions the server is willing to accept once the client-side gate is removed.
Know when Db2 Intelligence Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable application requiring an authenticated low-privileged user (PR:L); client-side control bypass permits unauthorized state-changing actions (I:H) with no disclosure or availability loss.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB