BaseFortify

Publication date: 2025-12-08

Last updated on: 2025-12-10

Assigner: IBM Corporation

Description

IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow a privileged user to bypass validation, passing user input into the application as trusted data, due to client-side enforcement of server-side security.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-08

Last Modified

2025-12-10

Generated

2026-07-06

AI Q&A

2025-12-09

EPSS Evaluated

2026-07-05

NVD

CVE-2025-36102

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	controller	11.1.0
ibm	cognos_controller	11.0.1
ibm	cognos_controller	11.0.0
ibm	controller	11.1.1
ibm	controller	From 11.1.0 (inc) to 11.1.2 (inc)
ibm	cognos_controller	From 11.0.0 (inc) to 11.0.1.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-602	The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM Controller and IBM Cognos Controller allows a privileged user to bypass validation by exploiting client-side enforcement of server-side security. Essentially, user input can be passed into the application as trusted data because the security validation is only enforced on the client side, not properly on the server side.

Impact Analysis

The vulnerability could allow a privileged user to inject unvalidated input into the application, potentially leading to integrity issues within the system. Although it does not impact confidentiality or availability, it could allow unauthorized modification or manipulation of data.

Hi! I’m here to help you understand CVE-2025-36102. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70