EUVD-2025-209029
GHSA-p29m-v6j2-fcqm
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V6 - Authentication Credential protection in transit/storage
|
| Impact | The risk profile presents mixed signals. The CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N vector indicates local attack vector (AV:L) with low complexity and no privileges required, making exploitation straightforward for any local user. However, the CVSS base score of 5.1 reflects limited scope (confidentiality and integrity impact only, no availability impact). The vulnerability's real-world exploitation likelihood depends on deployment architecture: in shared hosting or cloud environments with multiple tenant accounts, this represents elevated risk; in single-user or air-gapped installations, risk is minimal. The information disclosure component (CWE-522) is concerning if credentials or sensitive business data are exposed. Without confirmed active exploitation (KEV status unclear from provided data) or published POC availability, this remains a preventive patching priority rather than an emergency response scenario. SSVC assessment would classify this as LOW urgency if the system is isolated, but MEDIUM if local access is difficult to control. |
| Exploit ScenarioDerived | A disgruntled employee with a standard local user account on a server running IBM Concert logs in and directly invokes sensitive application functions through the Concert API or CLI without authentication checks. The attacker reads configuration files, extracts database credentials, or exports business process definitions containing proprietary logic. Alternatively, a compromised low-privilege service account on a multi-tenant system leverages the missing access control to access other tenants' sensitive data. The low attack complexity (AC:L) and lack of user interaction requirement (UI:N) mean the attacker can automate this exploitation via scripts or tools with minimal preparation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
IBM Concert versions 1.0.0 through 2.2.0 contain a missing function-level access control vulnerability that allows local users to obtain sensitive information without authentication. An attacker with local system access can bypass authorization checks to read confidential data stored within the application. While the CVSS score of 5.1 indicates moderate severity, the lack of authentication requirements and local attack vector present a meaningful risk in multi-tenant or shared system environments.
RemediationAI
Immediately upgrade IBM Concert to a patched version released after the vulnerability disclosure (consult the IBM support page at https://www.ibm.com/support/pages/node/7267105 for the specific target version and upgrade procedures). Before patching is feasible, apply compensating controls: restrict local system access through OS-level user account management and group policies, disable unnecessary local accounts, and implement filesystem-level access controls to prevent unauthorized process execution. Monitor Concert application logs for suspicious function invocations or unauthorized data access attempts. If Concert processes sensitive credentials, rotate all credentials post-remediation. Schedule patching during a maintenance window, as Concert is likely business-critical; test patches in a staging environment first to ensure compatibility with existing deployments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from inadequate implementation of function-level access control, classified under CWE-522 (Insufficiently Protected Credentials). IBM Concert, an enterprise collaboration and business process platform, fails to properly validate user permissions before exposing sensitive functionality. The affected versions (1.0.0 through 2.2.0) contain logic flaws where critical functions can be invoked without proper authentication or authorization checks. The vulnerability affects the core Concert application (identified via CPE cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*), meaning all installations within the affected version range are potentially exposed. This is a classic authorization bypass allowing horizontal privilege escalation or lateral movement from a compromised local account.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
IBM Concert 1.0.0 through 2.2.0 could allow a local user to obtain sensitive information due to missing function level access control.
Executive ViewAI
CVE-2025-36440 presents moderate security risk rated CVSS 5.1. Exploitation could compromise the security of affected deployments. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB