IBM EUVD-2025-209016

The risk assessment presents a nuanced picture. The CVSS score of 3.1 with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N indicates low severity: network-based attack (AV:N) requiring high complexity (AC:H), low privileges (PR:L), and no user interaction (UI:N), with only confidentiality impact (C:L) and no integrity or availability impact. However, this underestimates real-world risk because information disclosure vulnerabilities are often stepping stones to privilege escalation or lateral movement in enterprise environments. The attack complexity is high primarily due to the MITM requirement, but in unencrypted or poorly secured networks, this complexity decreases substantially. The requirement for low privileges suggests this is an authenticated information disclosure, limiting spontaneous exploitation but still concerning for insider threats or compromised accounts. Without EPSS score or KEV status provided, the patch availability and enterprise context suggest this is not a zero-day and is being actively addressed, reducing exploitation probability. For organizations with sensitive data in InfoSphere, this warrants prompt patching despite the low CVSS score.

An attacker positioned on the network path between an authenticated user and an InfoSphere Information Server instance (via compromised WiFi, ARP spoofing, or DNS hijacking) captures unencrypted HTTP traffic and observes GET requests containing sensitive query parameters such as authentication tokens, API keys, or database credentials. The attacker extracts these parameters from the query string, which are logged in proxy caches and browser history, allowing them to impersonate the legitimate user or escalate access to backend systems. This scenario is realistic in enterprise environments with legacy HTTP endpoints or during internal network pivots following an initial compromise.