« Volver al listado

CVE-2025-36117

Estado: AnalizadaMedia (6.3)—

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — DB2 Mirror FOR I

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-36117",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-36117",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-23T14:57:38.727275Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:db2_mirror_for_i:7.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:db2_mirror_for_i:7.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:db2_mirror_for_i:7.6:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Db2 Mirror for i",
          "versions": [
            {
              "status": "affected",
              "version": "7.4, 7.5, 7.6"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-23T15:15:31.867",
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7240351",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-384"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Db2 Mirror for i 7.4, 7.5, and 7.6 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system."
    },
    {
      "lang": "es",
      "value": "IBM Db2 Mirror para i 7.4, 7.5 y 7.6 no prohíbe el ID de sesión después de su uso, lo que podría permitir que un usuario autenticado se haga pasar por otro usuario en el sistema."
    }
  ],
  "lastModified": "2026-06-17T09:14:29.990",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:db2_mirror_for_i:7.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D81F028-D6CF-41BD-95A8-C6676C307E8D"
            },
            {
              "criteria": "cpe:2.3:a:ibm:db2_mirror_for_i:7.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37C5BD86-7FB3-445C-95F5-F3D7CE2C597A"
            },
            {
              "criteria": "cpe:2.3:a:ibm:db2_mirror_for_i:7.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75F1B598-7215-4B7D-A12E-13ABD5AECA0E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}