IBM EUVD-2025-209025

The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) indicates a network-accessible vulnerability with low attack complexity and no privilege requirements, but requiring user interaction and limited to integrity impact. The low CVSS base score of 4.3 reflects the constrained impact scope (single user context only, no confidentiality or availability loss). However, real-world risk assessment must consider that CSRF vulnerabilities against administrative or data engineering interfaces can have downstream consequences: an attacker could modify critical ETL workflows, corrupt data pipelines, or sabotage scheduled jobs, with impacts extending beyond the immediate integrity metric. The availability of a vendor patch and lack of indicated active exploitation via KEV status suggest this is not a critical emergency, but organizations running InfoSphere Information Server in production environments should prioritize patching due to the trusted nature of DataStage workflows in enterprise data operations. The requirement for user interaction (social engineering or email-based attack) slightly reduces exploitability compared to fully unauthenticated attacks.

An attacker crafts a malicious email or website containing an embedded request (via image tag, form, or JavaScript) targeting the DataStage Flow Designer. When an authenticated DataStage user clicks the link or visits the compromised website while logged into InfoSphere Information Server, the attacker's request executes with the user's credentials, potentially modifying or executing data flows. For example, the attacker could alter a critical customer data pipeline to exclude certain records or redirect outputs to an unauthorized location, causing downstream data integrity issues that may not be immediately detected.