IBM DOORS Next CVE-2025-2138

Requires a valid authenticated DOORS Next account (PR:L) with network reachability to the application; per the CVSS vector this is scoped to the adjacent network (AV:A). The core condition is the CWE-602 design flaw: comment-deletion authorization is enforced only client-side, so an authenticated user can issue a direct server request that the UI would normally block to delete another user's comments. Limiting factors: no anonymous/unauthenticated path (an account is mandatory), no user interaction from the victim is needed, impact is confined to comment integrity (no data read, no availability loss), and reach is adjacent-network per the vendor rating rather than fully internet-wide.

This is a genuinely low-priority issue, and the multiple signals agree. The provided CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) scores only 3.5 (Low): it requires an already-authenticated user (PR:L), limits reach to the adjacent network (AV:A), and produces only a low integrity impact (I:L) with no confidentiality or availability loss. EPSS reinforces this with a 0.18% exploitation probability (7th percentile), and the CVE is NOT in CISA KEV and has no known public POC - no evidence of real-world exploitation. The CWE-602 root cause (client-side enforcement of server-side security) means an authenticated user can bypass UI-level restrictions, but the consequence is narrow: deletion of other users' comments, a data-integrity/tampering nuisance rather than a path to code execution or data theft. One minor inconsistency worth noting: the input Tags label this 'Information Disclosure', but the CVSS vector (C:N, I:L) and the described behavior (deleting comments) make this an integrity/tampering issue, not disclosure - verify tagging. Also note the CVSS uses AV:A (adjacent) while DOORS Next is a web application typically reached over the broader network, which could arguably justify AV:N; this does not change the Low severity but affects reachability assumptions. Bottom line: a low-risk, low-CVSS issue with no exploitation signals - patch on normal maintenance cadence, not as an emergency.

An authenticated DOORS Next user with network access notices that comment-deletion restrictions are enforced only in the client UI. They craft a direct server request (bypassing the client-side control) to delete comments authored by other users, tampering with collaborative requirements discussions. No public exploit code has been identified, and exploitation yields only comment deletion, not data disclosure or system compromise.