IBM EUVD-2025-209040

The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) indicates a local attack vector with low complexity and high privilege requirement, resulting in high confidentiality impact but no integrity or availability impact. The 4.4 base score reflects the constrained attack surface (local access, high privileges required) despite the high confidentiality impact. This is a classic information disclosure vulnerability with moderate real-world risk: while an attacker must already have elevated local access, the lack of user interaction requirement and low attack complexity mean that once privileged access is obtained (via lateral movement, supply chain compromise, or insider threat), exploitation is trivial and guaranteed. The absence of public proof-of-concept and lack of reported active exploitation suggest this is not an immediately weaponized threat, but the availability of a vendor patch indicates IBM treats this as a legitimate priority. Under SSVC framework, this would rate as Moderate to Important depending on organizational context: the technical impact (confidential data disclosure) is significant, the required privileges are high (reducing immediate risk), and exploitation is not automatable by script kiddies but is trivial for an attacker with local system access.

An insider with system administrator or root access, or an external attacker who has achieved privilege escalation through a separate vulnerability, connects to the affected IBM Knowledge Catalog Standard Cartridge system and reads unencrypted application log files stored in the default log directory. Within minutes, they extract sensitive information such as database credentials, API tokens, or user personal data that was logged by the application. This information is then used to escalate further attacks, establish persistence, or exfiltrate data without triggering detection systems that monitor application-layer access. No user interaction or complex attack chain is required once local privileged access is obtained.