IBM Tivoli Monitoring
CVE-2025-3356
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Tivoli Monitoring web endpoint
-
DeliverySend crafted URL with '/../' sequences
-
ExploitTraverse outside web root
-
ExecutionRead, overwrite or append arbitrary files
-
ImpactDisclose secrets or corrupt system files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability of the IBM Tivoli Monitoring web interface - the CVSS vector (AV:N/AC:L/PR:N/UI:N) and description confirm a remote, unauthenticated attacker needs only to send a crafted URL containing '/../' dot-dot sequences against default configurations of IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21. Limiting factors: exploitation requires network access to the affected HTTP service (exposure is reduced if the management interface is segmented or not internet-facing), and only the specified 6.3.0.7 version train is affected, so other IBM Tivoli Monitoring releases are out of scope. |
| Impact | All provided signals point to a genuinely high-priority flaw rather than an inflated CVSS score. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated path traversal with full C:H/I:H/A:H impact, which is internally consistent with the description of crafting a URL with '/../' sequences to view, overwrite, or append arbitrary files. The write/append capability justifies the high integrity and availability impact, so the 9.8 rating is well-grounded rather than overstated. However, key corroborating signals are MISSING: no EPSS probability is provided, there is no CISA KEV listing, and no public POC is referenced - so exploitation is credible on paper but not yet evidenced in the wild. The absence of EPSS/KEV data means real-world exploitation likelihood cannot be quantified from the input; treat the network-reachable, unauthenticated nature as the primary driver of urgency. No signals conflict with each other here; the main caveat is simply that exploitation evidence (EPSS/KEV/POC) is absent, not contradictory. |
| Exploit ScenarioDerived | A remote attacker sends a specially crafted HTTP(S) URL containing '/../' directory-traversal sequences to an internet- or network-reachable IBM Tivoli Monitoring 6.3.0.7 endpoint. Because no authentication or user interaction is required, the attacker can read sensitive configuration or credential files, or overwrite/append to files to corrupt data or potentially stage code. No public exploit is identified at time of analysis, so weaponization would require the attacker to develop the request themselves. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Unauthenticated path traversal in IBM Tivoli Monitoring 6.3.0.7 (including all service packs through SP21) lets remote attackers send crafted URLs with '/../' sequences to read, overwrite, or append to arbitrary files on the server. With a CVSS score of 9.8, this flaw can lead to complete compromise of the monitoring infrastructure if the web interface is reachable. No public exploit code or active exploitation has been identified at time of analysis, but the risk is high due to the unauthenticated nature and the potential for code execution via file overwrite.
RemediationAI
Patch available per vendor advisory: apply the fix from IBM advisory 7249694 (https://www.ibm.com/support/pages/node/7249694). The exact patched version is not specified in the available data, but IBM typically releases an interim fix or a new service pack for such flaws; consult the advisory for the precise upgrade or patch instructions. If immediate patching is not possible, restrict network access to the IBM Tivoli Monitoring web interface to trusted IP addresses or segments-this reduces exposure but may limit remote management capabilities. Additionally, deploy file integrity monitoring on critical system and configuration files to detect attempted overwrites or appends. Disabling the web interface entirely is not recommended as it would impair core monitoring functions, but if the service is not needed externally, blocking it at the perimeter is a strong temporary mitigation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic path traversal (CWE-22) affecting the web interface of IBM Tivoli Monitoring 6.3.0.7. The software fails to properly sanitize user-supplied URL paths, allowing an attacker to insert '/../' dot-dot sequences that escape the intended directory and access files outside the web root. Because the flaw allows not only reading but also overwriting and appending to arbitrary files, an attacker could modify configuration files, scripts, or executables to achieve remote code execution or persistent backdoor access. The affected component is the HTTP service listening on the network; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms that no authentication or user interaction is required, and the impact on confidentiality, integrity, and availability is high. The CPE strings identify the base 6.3.0.7 release and its service packs (SP1 through SP17 in the provided list, and up to SP21 per the description) as vulnerable.
Know when Tivoli Monitoring gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated crafted URL (AV:N/AC:L/PR:N/UI:N); arbitrary file read gives C:H and overwrite/append gives I:H and A:H, scope unchanged.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view, overwrite, or append to arbitrary files on the system.
Executive ViewAI
IBM Tivoli Monitoring 6.3.0.7 (including all service packs through SP21) contains a critical path traversal flaw that could let remote attackers read, overwrite, or append arbitrary files on the server, risking full compromise of the monitoring infrastructure. No public exploit identified at time of analysis, but the potential for monitoring outages, data tampering, and downstream operational disruption makes this a priority for security leadership. Affected teams include IT operations, security monitoring, and any business functions relying on Tivoli for infrastructure visibility.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the Tivoli Monitoring web interface (firewall/ACL/VPN), deploying WAF rules to block path traversal sequences, network segmentation, least-privilege file permissions, file integrity monitoring, and enhanced logging/alerting for anomalous file access. Apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)NVD
More in Tivoli Monitoring
View allUnspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 an
IBM Tivoli Monitoring V6 6.2.2.x could allow a remote attacker to execute arbitrary code on the system, caused by a use-
Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Jav
Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 an
Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Jav
The portal client in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 through FP6 allows remo
The portal in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 before FP7 allows remote authe
IBM Tivoli Monitoring (ITM) 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, 6.2.3 through FP05, and 6.3.0 be
IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to execute arbitrary commands on the sys
Stack-based buffer overflow in the ax Shared Libraries in the Agent in IBM Tivoli Monitoring (ITM) 6.2.2 before FP9, 6.2
IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to modify SQL commands to the Portal Ser
Unauthenticated remote attackers can read arbitrary files from IBM Tivoli Monitoring 6.3.0.7 through Service Pack 21 by
GitHub PoC
Exploit-DB