CVE-2025-27907

CVSS v3 4.1 MEDIUM

4.1^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

BM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

References

Link	Resource
https://www.ibm.com/support/pages/node/7231514	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:websphere_application_server::::::::
	cpe:2.3:a:ibm:websphere_application_server::::::::

OR	cpe:2.3:o:hp:hp-ux:-:::::::*
	cpe:2.3:o:ibm:aix:-:::::::*
	cpe:2.3:o:ibm:i:-:::::::*
	cpe:2.3:o:ibm:z\/os:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*
	cpe:2.3:o:oracle:solaris:-:::::::*

History

18 Jul 2025, 15:51

Type	Values Removed	Values Added
First Time		Hp hp-ux Oracle solaris Ibm z\/os Ibm websphere Application Server Microsoft windows Ibm aix Linux linux Kernel Microsoft Ibm Linux Ibm i Oracle Hp
References	~~() https://www.ibm.com/support/pages/node/7231514 -~~	() https://www.ibm.com/support/pages/node/7231514 - Vendor Advisory
CPE		cpe:2.3:a:ibm:websphere_application_server:::::::: cpe:2.3:o:hp:hp-ux:-:::::::* cpe:2.3:o:ibm:z\/os:-:::::::* cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:o:ibm:aix:-:::::::* cpe:2.3:o:ibm:i:-:::::::* cpe:2.3:o:oracle:solaris:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::*

23 Apr 2025, 14:08

Type	Values Removed	Values Added
Summary		(es) IBM WebSphere Application Server 8.5 y 9.0 es vulnerable a server-side request forgery (SSRF). Esto podría permitir que un atacante autenticado envíe solicitudes no autorizadas desde el sistema, lo que podría provocar la enumeración de la red o facilitar otros ataques.