IBM Concert
CVE-2025-36160
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to Concert
-
ExploitRead leaked response headers
-
ImpactHarvest server info to aid follow-on attack
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection System info exposure prevention
|
| Exploitation Conditions | No special conditions beyond network reachability - a remote unauthenticated attacker can trigger the leak by sending normal HTTP requests to a running IBM Concert instance (1.0.0-2.0.0) and reading the response headers, with no authentication, user interaction, or non-default configuration required (AV:N/AC:L/PR:N/UI:N). The key LIMITING factor is impact scope: this is a reconnaissance/fingerprinting disclosure via HTTP response headers that only 'aids in further attacks' - it does not by itself grant access, modify data, or expose user credentials, so meaningful damage requires a separate chained vulnerability. |
| Impact | Signals are largely aligned toward LOW real-world priority despite the 7.5 'High' headline score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) correctly reflects that the data leak is reachable by remote, unauthenticated attackers with no user interaction, but the C:H rating is questionable: CWE-497 combined with a description limited to 'sensitive server information from HTTP response headers that could aid in further attacks' describes reconnaissance-grade disclosure (versions, internal identifiers, stack details), not exposure of credentials or user data. That typically warrants C:L, not C:H - the vendor-assigned C:H appears to inflate the score. EPSS corroborates low urgency at 0.05% (16th percentile), and the flaw is NOT in CISA KEV with no public POC identified. No SSVC decision data was provided. Net: this is a high-CVSS-but-low-real-risk issue - a stepping-stone information leak whose value depends on a chained follow-on exploit, not a standalone priority. Verify the confidentiality impact with IBM, as CVSS C:H conflicts with the recon-only nature implied by the description and CWE-497. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends ordinary HTTP requests to an IBM Concert instance and inspects the response headers, which leak sensitive server details (such as software versions or internal infrastructure identifiers). The attacker uses this fingerprinting data to select targeted exploits or craft more precise follow-on attacks against the disclosed components. No public exploit is required - the information is returned by default in normal responses. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Oct 18, 2026
IBM Concert 1.0.0 through 2.0.0 exposes sensitive server-side details through its HTTP response headers, letting remote attackers passively fingerprint the deployment - build/version banners, middleware or platform identifiers, and internal host or component names - and use that reconnaissance to plan follow-on attacks. The vendor scored this 7.5 (C:H), but the independently assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, because the leak by itself grants no access, alters no data, and exposes no credentials; meaningful harm requires chaining with a separate vulnerability. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified, and EPSS is only 0.05% (16th percentile), so real-world priority is low despite the High headline score.
Earlier versions of this analysis (2)
IBM Concert 1.0.0 through 2.0.0 exposes server-identifying details in HTTP response headers to unauthenticated remote clients, providing reconnaissance data that can inform follow-on attacks. The vendor/NVD score is 7.5, but the independent assessment rates the confidentiality impact as low because the leak reveals metadata rather than directly compromising data, making real-world priority depend on whether the Concert management interface is network-exposed. EPSS is 0.05% (16th percentile), and no public exploit or CISA KEV entry was identified at time of analysis.
IBM Concert 1.0.0 through 2.0.0 could disclose sensitive server information from HTTP response headers that could aid in further attacks against the system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
RemediationAI
Apply the fix level identified in IBM's security bulletin for Concert at https://www.ibm.com/support/pages/node/7252019 - the supplied data does not specify an exact fixed version, so confirm the corrected release number directly in that advisory before upgrading; no vendor-released patch version is independently confirmed here. If an upgrade cannot be scheduled immediately, actionable compensating controls are: terminate IBM Concert behind a reverse proxy or load balancer that rewrites or strips identifying response headers (Server, X-Powered-By, and any vendor-specific headers) - effective but requires header inventory maintenance and can break clients that key off those values; restrict network reachability so the instance is not internet-facing, limiting who can observe the headers at all - trade-off is reduced accessibility for legitimate remote users; and enable response/header monitoring or WAF logging to detect scanning that correlates with the disclosed stack. Note that none of these remove the underlying code defect, so patching remains the only complete fix, and because the leak is reconnaissance-only, prioritize it below vulnerabilities that directly enable access or code execution.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-497, Exposure of Sensitive System Information to an Unauthorized Control Sphere: the application emits information into a channel (here, HTTP response headers) that is readable by any party able to reach the service. In practice this means headers such as Server, X-Powered-By, and vendor- or framework-specific custom headers that reveal product name, exact version, build identifiers, application server, reverse proxy, or backend component names. This is a classic fingerprinting weakness rather than a memory-safety or injection flaw - the confidentiality impact is limited to metadata about the deployment, which an attacker would use to select exploits matching the disclosed stack or to map internal topology. Because the disclosure happens on ordinary requests, no authentication, user interaction, or non-default configuration is needed (AV:N/AC:L/PR:N/UI:N per the CVSS vector). The CPE cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:* combined with the vendor bulletin scopes the issue to IBM Concert releases 1.0.0 through 2.0.0; the underlying technology is the Concert application's web/HTTP layer, and the practical exposure scales directly with whether the instance is internet-facing or restricted to an internal network segment.
Know when Concert gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated header disclosure keeps AV:N/AC:L/PR:N/UI:N, but CWE-497 recon-level server info in headers warrants C:L (not C:H), with no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
IBM Concert 1.0.0 through 2.0.0 could disclose sensitive server information from HTTP response headers that could aid in further attacks against the system.
Executive ViewAI
IBM Concert 1.0.0 through 2.0.0 can expose deployment fingerprints through HTTP response headers, giving remote unauthenticated observers information about build versions, middleware, and internal host or component names that may aid follow-on attack planning. No public exploit identified at time of analysis, and the issue by itself does not grant access, alter data, or expose credentials, so near-term business risk is limited despite the High severity score. Leadership should prioritize reducing internet exposure and header leakage for affected Concert deployments while tracking vendor guidance, because externally reachable instances could still provide useful reconnaissance to attackers.
No vendor-released patch identified at time of analysis; restrict network exposure of IBM Concert 1.0.0 through 2.0.0, strip or normalize sensitive HTTP response headers at the reverse proxy or WAF, avoid direct internet access, monitor for reconnaissance activity, and review vendor advisory for updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
Unauthenticated remote code execution in IBM Concert 1.0.0 through 3.0.0 lets any attacker who can reach the service sen
Use-after-free in IBM Concert 1.0.0 through 3.0.0 lets an attacker who can influence program input or execution flow cor
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8)
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Rated
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statem
Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local, authenticated user supply overlong input that
Local code execution in IBM Concert 1.0.0 through 2.1.0 allows an authenticated attacker to overflow a stack buffer and
Local privilege escalation in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already holds a low-privileged accoun
Heap memory corruption in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already has low-privileged local access t
GitHub PoC
Exploit-DB