CVE-2025-36361 - Vulnerability Details - OpenCVE

IBM App Connect Enterprise 13.0.1.0 through 13.0.4.2, and 12.0.1.0 through 12.0.12.17 could allow an authenticated user to perform unauthorized actions on customer defined resources due to missing authorization.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ibm	App Connect Enterprise

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7249061

History

Sat, 25 Oct 2025 02:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-862

Fri, 24 Oct 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 24 Oct 2025 09:45:00 +0000

Type	Values Removed	Values Added
Description		IBM App Connect Enterprise 13.0.1.0 through 13.0.4.2, and 12.0.1.0 through 12.0.12.17 could allow an authenticated user to perform unauthorized actions on customer defined resources due to missing authorization.
Title		IBM App Connect Enterprise runtime is vulnerable to a lack of authorization on windows environments using IWA
First Time appeared		Ibm Ibm app Connect Enterprise
CPEs		cpe:2.3:a:ibm:app_connect_enterprise:12.0.1.0:::::::* cpe:2.3:a:ibm:app_connect_enterprise:12.0.12.17:::::::* cpe:2.3:a:ibm:app_connect_enterprise:13.0.1.0:::::::* cpe:2.3:a:ibm:app_connect_enterprise:13.0.4.2:::::::*
Vendors & Products		Ibm Ibm app Connect Enterprise
References		https://www.ibm.com/support/pages/node/7249061
Metrics		cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2025-10-24T09:35:20.590Z

Updated: 2025-10-25T02:03:18.631Z

Reserved: 2025-04-15T21:16:55.331Z

Link: CVE-2025-36361

Vulnrichment

Updated: 2025-10-24T13:19:12.854Z

NVD

Status : Received

Published: 2025-10-24T10:15:38.670

Modified: 2025-10-25T02:15:39.550

Link: CVE-2025-36361

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-36361", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:16:55.331Z", "datePublished": "2025-10-24T09:35:20.590Z", "dateUpdated": "2025-10-25T02:03:18.631Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:app_connect_enterprise:12.0.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:app_connect_enterprise:13.0.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:app_connect_enterprise:13.0.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:app_connect_enterprise:12.0.12.17:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "App Connect Enterprise", "vendor": "IBM", "versions": [{"lessThanOrEqual": "13.0.4.2", "status": "affected", "version": "13.0.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.0.12.17", "status": "affected", "version": "12.0.1.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IBM App Connect Enterprise 13.0.1.0 through 13.0.4.2, and 12.0.1.0 through 12.0.12.17 could allow an authenticated user to perform unauthorized actions on customer defined resources due to missing authorization.</p>"}], "value": "IBM App Connect Enterprise 13.0.1.0 through 13.0.4.2, and 12.0.1.0 through 12.0.12.17 could allow an authenticated user to perform unauthorized actions on customer defined resources due to missing authorization."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-10-25T02:03:18.631Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7249061"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Remediation/Fixes Affected Product(s) Versions(s) APAR Remediation / Fixes IBM App Connect Enterprise 13.0.1.0 - 13.0.4.2 IT48403 The APAR (IT48403) is available from IBM App Connect Enterprise v13- Fix Pack Release 13.0.5.0 IBM App Connect Enterprise 12.0.1.0 - 12.0.12.17 IT48403 The APAR (IT48403) is available from IBM App Connect Enterprise v12- Fix Pack Release 12.0.12.18</p>"}], "value": "Remediation/Fixes Affected Product(s) Versions(s) APAR Remediation / Fixes IBM App Connect Enterprise 13.0.1.0 - 13.0.4.2 IT48403 The APAR (IT48403) is available from IBM App Connect Enterprise v13- Fix Pack Release 13.0.5.0 IBM App Connect Enterprise 12.0.1.0 - 12.0.12.17 IT48403 The APAR (IT48403) is available from IBM App Connect Enterprise v12- Fix Pack Release 12.0.12.18"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM App Connect Enterprise runtime is vulnerable to a lack of authorization on windows environments using IWA", "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-24T13:19:00.627097Z", "id": "CVE-2025-36361", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-24T13:19:22.209Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36361", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-24T13:19:00.627097Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-24T13:19:12.854Z"}}], "cna": {"title": "IBM App Connect Enterprise runtime is vulnerable to a lack of authorization on windows environments using IWA", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:app_connect_enterprise:12.0.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:app_connect_enterprise:13.0.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:app_connect_enterprise:13.0.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:app_connect_enterprise:12.0.12.17:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "App Connect Enterprise", "versions": [{"status": "affected", "version": "13.0.1.0", "versionType": "semver", "lessThanOrEqual": "13.0.4.2"}, {"status": "affected", "version": "12.0.1.0", "versionType": "semver", "lessThanOrEqual": "12.0.12.17"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Remediation/Fixes Affected Product(s) Versions(s) APAR Remediation / Fixes IBM App Connect Enterprise 13.0.1.0 - 13.0.4.2 IT48403 The APAR (IT48403) is available from IBM App Connect Enterprise v13- Fix Pack Release 13.0.5.0 IBM App Connect Enterprise 12.0.1.0 - 12.0.12.17 IT48403 The APAR (IT48403) is available from IBM App Connect Enterprise v12- Fix Pack Release 12.0.12.18", "supportingMedia": [{"type": "text/html", "value": "<p>Remediation/Fixes Affected Product(s) Versions(s) APAR Remediation / Fixes IBM App Connect Enterprise 13.0.1.0 - 13.0.4.2 IT48403 The APAR (IT48403) is available from IBM App Connect Enterprise v13- Fix Pack Release 13.0.5.0 IBM App Connect Enterprise 12.0.1.0 - 12.0.12.17 IT48403 The APAR (IT48403) is available from IBM App Connect Enterprise v12- Fix Pack Release 12.0.12.18</p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7249061", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM App Connect Enterprise 13.0.1.0 through 13.0.4.2, and 12.0.1.0 through 12.0.12.17 could allow an authenticated user to perform unauthorized actions on customer defined resources due to missing authorization.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM App Connect Enterprise 13.0.1.0 through 13.0.4.2, and 12.0.1.0 through 12.0.12.17 could allow an authenticated user to perform unauthorized actions on customer defined resources due to missing authorization.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-10-24T09:35:20.590Z"}}}, "cveMetadata": {"cveId": "CVE-2025-36361", "state": "PUBLISHED", "dateUpdated": "2025-10-24T13:19:22.209Z", "dateReserved": "2025-04-15T21:16:55.331Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2025-10-24T09:35:20.590Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}