CVE-2025-27368

IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points used by the user interface of OpenPages. An authenticated user is able to obtain certain information about system metadata for areas beyond what the user is intended to view.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7250238	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:openpages:9.0.0:::::::*
	cpe:2.3:a:ibm:openpages:9.1.0:::::::*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) IBM OpenPages 9.0 y 9.1 es vulnerable a la revelación de información sensible debido a una seguridad más débil de lo esperado para ciertos puntos finales REST utilizados por la interfaz de usuario de OpenPages. Un usuario autenticado puede obtener cierta información sobre metadatos del sistema para áreas más allá de lo que el usuario está destinado a ver.

Information

Published : 2025-11-12 20:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-27368

Mitre link : CVE-2025-27368

CVE.ORG link : CVE-2025-27368

JSON object : View

Products Affected

ibm

openpages

CWE

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

{"id": "CVE-2025-27368", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-27368", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T20:45:34.221716Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:openpages:9.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:openpages:9.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "OpenPages", "versions": [{"status": "affected", "version": "9.0"}, {"status": "affected", "version": "9.1"}]}]}], "published": "2025-11-12T20:15:41.480", "references": [{"url": "https://www.ibm.com/support/pages/node/7250238", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-497"}]}], "descriptions": [{"lang": "en", "value": "IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points used by the user interface of OpenPages. An authenticated user is able to obtain certain information about system metadata for areas beyond what the user is intended to view."}, {"lang": "es", "value": "IBM OpenPages 9.0 y 9.1 es vulnerable a la revelaci\u00f3n de informaci\u00f3n sensible debido a una seguridad m\u00e1s d\u00e9bil de lo esperado para ciertos puntos finales REST utilizados por la interfaz de usuario de OpenPages. Un usuario autenticado puede obtener cierta informaci\u00f3n sobre metadatos del sistema para \u00e1reas m\u00e1s all\u00e1 de lo que el usuario est\u00e1 destinado a ver."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:openpages:9.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8ACBB76-355D-43F6-851E-0B79EE52AC19"}, {"criteria": "cpe:2.3:a:ibm:openpages:9.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F78E4CFE-31E7-4FFF-8DB4-6D7AC69A2248"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}