EUVD-2026-58366
GHSA-wv43-5q36-5wg7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Adjacent vector (AV:A) confines exploitation to local network segments; no authentication required (PR:N); impact is limited to low confidentiality disclosure of documentation content with no integrity or availability effect.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote attacker to obtain sensitive information due to a security misconfiguration where the documentation server binds to an unrestricted IP address.
AnalysisAI
Information disclosure in IBM Documentation Offline 1.0.0 through 1.4.1 exposes sensitive documentation content to unauthenticated adjacent network attackers due to the server binding to an unrestricted IP address (0.0.0.0 or equivalent) rather than restricting to localhost. The CVSS vector (AV:A/PR:N) confirms exploitation requires no credentials and is limited to the local network segment - internet-facing exploitation is not possible. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | IBM Documentation Offline must be installed, actively running, and bound to an unrestricted IP address (the vulnerable default behavior in versions 1.0.0-1.4.1). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 4.3 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects a moderate but structurally constrained risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker connected to the same local network segment (office LAN, Wi-Fi, or shared VLAN) as a host running IBM Documentation Offline discovers the listening port via a local network scan, then issues unauthenticated HTTP requests directly to the server's IP address to retrieve documentation content. No credentials or special tooling are required beyond a basic HTTP client or web browser. … |
| Remediation | Apply the vendor-released patch per IBM advisory at https://www.ibm.com/support/pages/node/7283484; the exact fixed version is not independently confirmed from the available data and should be verified against the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Documentation Offline
View allRemote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 allows an attacker to run arbitrary code by abusi
Remote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 stems from improper neutralization of output writ
Path traversal in IBM Documentation Offline 1.0.0 through 1.4.1 enables unauthenticated remote attackers to read arbitra
Session token forgery is possible in IBM Documentation Offline versions 1.0.0 through 1.4.1 because the application uses
Same weakness CWE-1327 – Binding to an Unrestricted IP Address
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today