CVE-2025-36102
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-08

Last updated on: 2025-12-10

Assigner: IBM Corporation

Description
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow a privileged user to bypass validation, passing user input into the application as trusted data, due to client-side enforcement of server-side security.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-08
Last Modified
2025-12-10
Generated
2026-06-16
AI Q&A
2025-12-09
EPSS Evaluated
2026-06-15
NVD
CVE-2025-36102
Affected Vendors & Products
Showing 6 associated CPEs
Vendor Product Version / Range
ibm controller 11.1.0
ibm cognos_controller 11.0.1
ibm cognos_controller 11.0.0
ibm controller 11.1.1
ibm controller From 11.1.0 (inc) to 11.1.2 (inc)
ibm cognos_controller From 11.0.0 (inc) to 11.0.1.7 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-602 The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in IBM Controller and IBM Cognos Controller allows a privileged user to bypass validation by exploiting client-side enforcement of server-side security. Essentially, user input can be passed into the application as trusted data because the security validation is only enforced on the client side, not properly on the server side.

Impact Analysis

The vulnerability could allow a privileged user to inject unvalidated input into the application, potentially leading to integrity issues within the system. Although it does not impact confidentiality or availability, it could allow unauthorized modification or manipulation of data.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-36102. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart