« Volver al listado

CVE-2025-36355

Estado: AnalizadaAlta (8.5)—

IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0

could allow a locally authenticated user to execute malicious scripts from outside of its control sphere.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L sin UI:N indica escalada local sin interacción (T1068). Usuario autenticado ejecuta scripts maliciosos (T1059), con potencial de manipular datos del sistema (CWE-829: descargas no validadas).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data Storage

Tecnologías afectadas (4)

IBM — Security Verify AccessIBM — Security Verify Access DockerIBM — Verify Identity AccessIBM — Verify Identity Access Docker

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-36355",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-36355",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-10-06T19:59:22.629391Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.5,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.3,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:security_verify_access:10.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access:10.0.9.0:interm_fix2:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access:11.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access:11.0.1.0:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Security Verify Access Appliance",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.0.9.0 IF2"
            },
            {
              "status": "affected",
              "version": "11.0.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "11.0.1.0"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:security_verify_access_docker:10.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access_docker:10.0.9.0:interm_fix2:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access_docker:11.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access_docker:11.0.1.0:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Security Verify Access Docker",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.0.9.0 IF2"
            },
            {
              "status": "affected",
              "version": "11.0.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "11.0.1.0"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-10-06T17:16:05.320",
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7247215",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-829"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 \n\ncould allow a locally authenticated user to execute malicious scripts from outside of its control sphere."
    }
  ],
  "lastModified": "2026-06-17T09:14:39.760",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CCA4ADF8-014B-4A43-AE12-CC7D46B0F8BF",
              "versionEndExcluding": "10.0.9.0",
              "versionStartIncluding": "10.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.9.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9916DF0F-8A3E-4CB4-957F-286E168666A2"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.9.0:interim_fix1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05FBA01C-DDCD-4B80-B14B-81DAB052CC8D"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.9.0:interim_fix2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "149CA168-1117-4B50-8F5A-B72D4BCC65F1"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access_docker:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FFF4D7D4-0D01-44CA-84A2-2EA59802D1CB",
              "versionEndExcluding": "10.0.9.0",
              "versionStartIncluding": "10.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access_docker:10.0.9.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7E76C6CF-1E2A-403E-9C7F-619BE2057468"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access_docker:10.0.9.0:interim_fix1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8BF3374-6B03-4A25-9F4D-F88C091804C7"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access_docker:10.0.9.0:interim_fix2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8D09601-F55B-4307-8BEE-218F5CAC2138"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:verify_identity_access:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16595130-3A46-4DD1-9DAA-53E534306975",
              "versionEndExcluding": "11.0.1.0",
              "versionStartIncluding": "11.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:verify_identity_access:11.0.1.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A7A934C-F8B6-44D1-9591-A3FDB86BEECB"
            },
            {
              "criteria": "cpe:2.3:a:ibm:verify_identity_access_docker:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81BD4D96-C9E9-422B-B18A-61ECFE711884",
              "versionEndExcluding": "11.0.1.0",
              "versionStartIncluding": "11.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:verify_identity_access_docker:11.0.1.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C06D5AD-67DD-46FA-BDF7-39A2E0EAAF95"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}