IBM EUVD-2025-209022

While the CVSS 3.1 score of 5.7 (Medium) reflects a confidentiality impact with low attack complexity, the real-world risk is context-dependent but material. The CVSS vector (AV:A/AC:L/PR:L/UI:N/S:U) indicates the attack requires network adjacency and low-privilege authentication—realistic in enterprise environments where InfoSphere deployments typically exist. The vulnerability is NOT reported as actively exploited in known exploit databases, nor is KEV listing status provided, suggesting it has not reached widespread weaponization. However, the absence of public POC availability and lack of EPSS data provided does not mean exploitation is difficult—IDOR vulnerabilities are trivial to exploit once access is gained. The key risk amplifier is that this affects data governance infrastructure: an attacker with valid credentials can systematically enumerate and exfiltrate metadata, job definitions, and potentially credential references stored in InfoSphere's repository, creating significant downstream risk for data security. For organizations heavily dependent on InfoSphere, this merits immediate patching despite the medium CVSS score, particularly if the environment handles sensitive data lineage or regulatory metadata.

An employee with low-privilege access to InfoSphere Information Server (perhaps a junior analyst with read-only permissions) could systematically modify HTTP request parameters or API calls to view data assets, transformation jobs, and metadata configurations belonging to other users or departments. For example, changing a resource ID parameter in an API call from their own user context to target administrative or data science team assets would return unauthorized data due to insufficient authorization validation. Because the attack vector is local network (AV:A) and requires valid credentials (PR:L), this is feasible in enterprise environments where InfoSphere is commonly deployed behind corporate firewalls with Active Directory authentication. No known public POC has been released, but IDOR exploitation is trivial to perform manually once the vulnerability is known, making this a significant risk in any organization where user credentials are compromised or shared.