CVE-2025-1350

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7287970

Configurations

No configuration.

History

14 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) IBM Controller desde 11.0.0 hasta 11.0.1 FP7, y desde 11.1.0 hasta 11.1.3 FP1 podría permitir a un atacante remoto obtener información sensible cuando se devuelve un mensaje de error técnico detallado en el navegador. Esta información podría utilizarse en ataques posteriores contra el sistema.

18 Sep 2026, 15:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-18 15:17

Updated : 2026-10-14 18:10

NVD link : CVE-2025-1350

Mitre link : CVE-2025-1350

CVE.ORG link : CVE-2025-1350

JSON object : View

Products Affected

No product.

CWE

CWE-209

Generation of Error Message Containing Sensitive Information

{"id": "CVE-2025-1350", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-1350", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-19T13:45:16.675328Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:controller:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:controller:11.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:controller:11.1.3:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Controller", "versions": [{"status": "affected", "version": "11.0.0", "versionType": "semver", "lessThanOrEqual": "11.0.1 FP7"}, {"status": "affected", "version": "11.1.0", "versionType": "semver", "lessThanOrEqual": "11.1.3 FP1"}]}]}], "published": "2026-09-18T15:17:04.343", "references": [{"url": "https://www.ibm.com/support/pages/node/7287970", "source": "psirt@us.ibm.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system."}, {"lang": "es", "value": "IBM Controller desde 11.0.0 hasta 11.0.1 FP7, y desde 11.1.0 hasta 11.1.3 FP1 podr\u00eda permitir a un atacante remoto obtener informaci\u00f3n sensible cuando se devuelve un mensaje de error t\u00e9cnico detallado en el navegador. Esta informaci\u00f3n podr\u00eda utilizarse en ataques posteriores contra el sistema."}], "lastModified": "2026-10-14T18:10:00.207", "sourceIdentifier": "psirt@us.ibm.com"}