IBM CVE-2025-14912

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network accessibility with low attack complexity, but importantly requires authentication (PR:L), reducing opportunistic exploitation risk. The moderate severity score of 5.4 reflects confidentiality and integrity impact without availability loss. Real-world risk depends on: (1) deployment context—InfoSphere servers typically reside in data-heavy enterprise environments with access to sensitive systems, making lateral movement via SSRF high-impact; (2) the availability of a vendor patch significantly reduces exploitability window; (3) the authenticated requirement filters out unauthenticated threat actors but does not eliminate risk from compromised or malicious insiders. This is not a trivial CVSS-score inflation; the SSRF class inherently enables network reconnaissance and can chain with other vulnerabilities. Priority should align with your organization's data governance role and internal network trust assumptions.

An authenticated user or insider with valid InfoSphere credentials crafts a specially formatted request (e.g., via the web interface or API) that includes a URL parameter pointing to an internal service—such as a cloud metadata endpoint (169.254.169.254), internal database server, or administrative API running on localhost. The vulnerable InfoSphere component fails to validate the target URL and instead makes the request on behalf of the server, returning the response to the attacker. The attacker leverages this to enumerate internal network topology, extract cloud credentials from metadata services, or attack internal systems that would otherwise be unreachable. No public POC is noted in available intelligence, but the authenticated vector and low attack complexity make exploitation straightforward once credentials are obtained.