CVE-2025-14290

IBM webMethods Integration (on prem) -Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 IBM webMethods Integration is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7273550	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:webmethods_integration_server:10.15.0:::::::*
	cpe:2.3:a:ibm:webmethods_integration_server:11.1.0:::::::*

History

No history.

Information

Published : 2026-05-26 17:16

Updated : 2026-07-24 11:10

NVD link : CVE-2025-14290

Mitre link : CVE-2025-14290

CVE.ORG link : CVE-2025-14290

JSON object : View

Products Affected

ibm

webmethods_integration_server

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2025-14290", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14290", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T18:34:12.833084Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:webmethods_integration_on_prem__integration_server:10.15:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:webmethods_integration_on_prem__integration_server:10.15.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:webmethods_integration_on_prem__integration_server:is_10.15_core_fix2611.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "webMethods Integration (on prem) -Integration Server", "versions": [{"status": "affected", "version": "10.15", "versionType": "semver", "lessThanOrEqual": "IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10"}]}]}], "published": "2026-05-26T17:16:28.417", "references": [{"url": "https://www.ibm.com/support/pages/node/7273550", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "IBM webMethods Integration (on prem) -Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 IBM webMethods Integration is vulnerable to server-side request forgery (SSRF). This may allow an authenticated\u00a0attacker to send unauthorized requests from the system, potentially leading to network enumeration or\u00a0facilitating other attacks."}, {"lang": "es", "value": "IBM webMethods Integration (en las instalaciones) -Integration Server 10.15 desde IS_10.15_Core_Fix2611.1 hasta IS_11.1_Core_Fix10 IBM webMethods Integration es vulnerable a falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF). Esto puede permitir a un atacante autenticado enviar peticiones no autorizadas desde el sistema, lo que podr\u00eda conducir a la enumeraci\u00f3n de red o facilitar otros ataques."}], "lastModified": "2026-07-24T11:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:webmethods_integration_server:10.15.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBAAEBC9-385F-4F88-BE43-742BB80A8CDD"}, {"criteria": "cpe:2.3:a:ibm:webmethods_integration_server:11.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA439BCF-0074-48D7-BE5B-E1BE33D22128"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}