IBM Tivoli Monitoring CVE-2025-3355

Requires network reachability to the Tivoli Monitoring HTTP service, which must be exposed to the attacker. No authentication is required (PR:N) and no user interaction is needed (UI:N), so default network-exposed deployments of IBM Tivoli Monitoring 6.3.0.7 through Service Pack 21 are exploitable by crafting a URL containing '/../' sequences. The primary limiting factor is network exposure of the management/web interface - environments that restrict the Tivoli web port to trusted management networks substantially reduce realistic risk. Impact is bounded to reading files accessible to the service account; no write or code-execution capability is indicated.

This is a genuine but moderate-priority exposure. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is self-consistent with the description: a remote, unauthenticated attacker can send a crafted URL over the network with low complexity and no user interaction, yielding high confidentiality impact (C:H) with no integrity or availability effect (I:N/A:N) - consistent with arbitrary file disclosure via path traversal (CWE-22). No EPSS probability was supplied, and the vulnerability is NOT in CISA KEV; no public POC is referenced. Thus the single credible exploitation-ease signal is the CVSS vector itself. The absence of KEV and POC data means there is no evidence of active or imminent widespread exploitation, so this should be prioritized as a standard high-severity patch rather than an emergency: easy to exploit in principle, but information-disclosure-only and not currently known to be weaponized. The sole reference is the vendor advisory, so exploitation telemetry is simply unavailable rather than confirmed low.

A remote, unauthenticated attacker sends an HTTP request to the Tivoli Monitoring web interface containing '/../' dot-dot sequences in the URL path, causing the server to resolve the path outside the intended web root and return the contents of arbitrary files (e.g., configuration files or credential stores). No public exploit code is referenced, but the technique is trivial and requires no authentication or user interaction.