What is the CVSS score of CVE-2025-14811?

CVE-2025-14811 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of IBM are affected by CVE-2025-14811?

CVE-2025-14811 is a low-severity vulnerability (CVSS 3.1). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

How to fix or mitigate CVE-2025-14811?

During next maintenance window: Apply vendor patches when convenient. Vendor patch is available.

IBM CVE-2025-14811

EUVD-2025-208653 LOW

Use of GET Request Method With Sensitive Query Strings (CWE-598)

2026-03-13 ibm

Information Disclosure IBM

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 02, 2026 - 12:16 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 19:00 euvd

EUVD-2025-208653

Analysis Generated

Mar 13, 2026 - 19:00 vuln.today

CVE Published

Mar 13, 2026 - 18:22 nvd

LOW 3.1

DescriptionCVE.org

IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques.

AnalysisAI

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Use of GET Request Method With Sensitive Query Strings (CWE-598).

RemediationAI

A vendor patch is available — apply it immediately. Implement proper access controls. Sanitize error messages in production. Review logging practices to avoid capturing sensitive data.