BaseFortify

Publication date: 2025-12-08

Last updated on: 2025-12-10

Assigner: IBM Corporation

Description

IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 is vulnerable to creation of temporary files without atomic operations which may expose sensitive information to an authenticated user due to race condition attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-08

Last Modified

2025-12-10

Generated

2026-07-06

AI Q&A

2025-12-09

EPSS Evaluated

2026-07-05

NVD

CVE-2025-33111

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	controller	11.1.0
ibm	cognos_controller	11.0.1
ibm	cognos_controller	11.0.0
ibm	controller	11.1.1
ibm	controller	From 11.1.0 (inc) to 11.1.2 (inc)
ibm	cognos_controller	From 11.0.0 (inc) to 11.0.1.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-379	The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

Attack-Flow Graph

Executive Summary

This vulnerability exists in IBM Controller versions 11.1.0 through 11.1.1 and IBM Cognos Controller versions 11.0.0 through 11.0.1 FP6. It involves the creation of temporary files without using atomic operations, which can lead to race condition attacks. Because of this, an authenticated user may be able to access sensitive information that should otherwise be protected.

Impact Analysis

The vulnerability can expose sensitive information to an authenticated user due to race condition attacks on temporary files. This means that unauthorized access to sensitive data could occur, potentially leading to information disclosure.

Hi! I’m here to help you understand CVE-2025-33111. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70