CVE-2025-36102
BaseFortify
Publication date: 2025-12-08
Last updated on: 2025-12-10
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | controller | 11.1.0 |
| ibm | cognos_controller | 11.0.1 |
| ibm | cognos_controller | 11.0.0 |
| ibm | controller | 11.1.1 |
| ibm | controller | From 11.1.0 (inc) to 11.1.2 (inc) |
| ibm | cognos_controller | From 11.0.0 (inc) to 11.0.1.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-602 | The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in IBM Controller and IBM Cognos Controller allows a privileged user to bypass validation by exploiting client-side enforcement of server-side security. Essentially, user input can be passed into the application as trusted data because the security validation is only enforced on the client side, not properly on the server side.
How can this vulnerability impact me? :
The vulnerability could allow a privileged user to inject unvalidated input into the application, potentially leading to integrity issues within the system. Although it does not impact confidentiality or availability, it could allow unauthorized modification or manipulation of data.