« Volver al listado

CVE-2025-14290

Estado: AnalizadaMedia (5.4)—

IBM webMethods Integration (on prem) -Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 IBM webMethods Integration is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — Webmethods Integration Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-14290",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-14290",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-26T18:34:12.833084Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:webmethods_integration_on_prem__integration_server:10.15:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:webmethods_integration_on_prem__integration_server:10.15.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:webmethods_integration_on_prem__integration_server:is_10.15_core_fix2611.1:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "webMethods Integration (on prem) -Integration Server",
          "versions": [
            {
              "status": "affected",
              "version": "10.15",
              "versionType": "semver",
              "lessThanOrEqual": "IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-26T17:16:28.417",
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7273550",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM webMethods Integration (on prem) -Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 IBM webMethods Integration is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks."
    },
    {
      "lang": "es",
      "value": "IBM webMethods Integration (en las instalaciones) -Integration Server 10.15 desde IS_10.15_Core_Fix2611.1 hasta IS_11.1_Core_Fix10 IBM webMethods Integration es vulnerable a falsificación de petición del lado del servidor (SSRF). Esto puede permitir a un atacante autenticado enviar peticiones no autorizadas desde el sistema, lo que podría conducir a la enumeración de red o facilitar otros ataques."
    }
  ],
  "lastModified": "2026-07-24T11:10:00.170",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:webmethods_integration_server:10.15.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBAAEBC9-385F-4F88-BE43-742BB80A8CDD"
            },
            {
              "criteria": "cpe:2.3:a:ibm:webmethods_integration_server:11.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA439BCF-0074-48D7-BE5B-E1BE33D22128"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}