EUVD-2026-83138
GHSA-f9fr-4j89-3fgq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable service with low-privilege authentication (PR:L) and no user interaction; verbose errors leak limited data (C:L) with no integrity or availability impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data.
AnalysisAI
Sensitive information exposure in IBM Common Licensing Agent 9.0 through 9.0.0.2 and IBM Administration and Reporting Tool (ART) 9.0 through 9.0.0.2 allows an authenticated low-privilege user to cause error messages to reveal environment, user, or associated data details. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (CVSS 4.3), so exploitation requires valid authentication, has low complexity, and yields only reconnaissance-grade confidentiality impact with no integrity or availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated low-privilege account on the IBM Common Licensing Agent or Administration and Reporting Tool (ART), versions 9.0 through 9.0.0.2 (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority information-disclosure issue, not a high-severity flaw dressed up. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Common Licensing
View allCross-site request forgery in IBM Common Licensing Agent and ART 9.0.x allows remote attackers to execute unauthorized a
Done. The JSON synthesis is above. Summary of the analysis: - **What it is:** An open redirect / HTTP Host header injec
IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for
IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have acce
IBM Common Licensing Agent and ART versions 9.0 through 9.0.0.2 enforce input validation only on the client side, leavin
IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user. Rated medium sev
Cross-site scripting in the IBM Common Licensing Agent and ART Web UI (9.0, 9.0.0.1, 9.0.0.2) lets an unauthenticated at
Cross-site scripting in IBM Common Licensing Agent 9.0 through 9.0.0.2 and ART 9.0 through 9.0.0.2 lets remote, unauthen
Cross-site scripting (XSS) in the IBM Common Licensing Agent (9.0, 9.0.0.1, 9.0.0.2) and IBM ART (9.0, 9.0.0.1, 9.0.0.2)
Cross-site scripting in IBM Common Licensing Agent and ART versions 9.0, 9.0.0.1, and 9.0.0.2 allows a user who already
IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerabil
Same weakness CWE-209 – Error Message Information Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today