Can you explain this vulnerability to me?

CVE-2025-13490 is a vulnerability in IBM App Connect Enterprise Certified Container products where data is transmitted in clear text. This means that sensitive information sent by the container to a Prometheus instance within an OpenShift cluster is not encrypted.

Because the data is unencrypted, an attacker could potentially intercept this information using man-in-the-middle (MITM) techniques, leading to a loss of confidentiality.

Useful 0 Not Useful 0

How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

I don't know

Useful 0 Not Useful 0

How can this vulnerability be detected on my network or system? Can you suggest some commands?

The vulnerability involves IBM App Connect Enterprise Certified Container transmitting metrics data in clear text over the network, which can be intercepted via man-in-the-middle attacks.

To detect this vulnerability on your network or system, you can monitor network traffic for unencrypted Prometheus metrics data being sent from IBM App Connect Enterprise Certified Container components within an OpenShift cluster.

Commands to help detect this include using network packet capture tools such as tcpdump or Wireshark to inspect traffic on the relevant ports (typically Prometheus metrics ports, e.g., 9090 or custom configured ports). For example:

• tcpdump -i <interface> port 9090 -w capture.pcap
• Followed by analyzing the capture with Wireshark to check if the metrics data is transmitted in clear text (unencrypted HTTP rather than HTTPS).

Additionally, checking the configuration of the IBM App Connect Enterprise Certified Container Operator and its components to verify if metrics reporting is enabled and whether encryption is configured can help identify vulnerable setups.

Useful 0 Not Useful 0

What immediate steps should I take to mitigate this vulnerability?

The primary mitigation for this vulnerability is to upgrade affected IBM App Connect Operator and IBM App Connect Enterprise Certified Container components to fixed versions that address the issue.

• For Continuous Delivery (CD) versions up to 12.20.1, upgrade the App Connect Enterprise Certified Container Operator to version 12.21.0 or higher.
• Ensure all DesignerAuthoring, IntegrationServer, and IntegrationRuntime components are upgraded to version 13.0.6.2-r1 or higher.
• For Long Term Support (LTS) versions 12.0.x, upgrade the App Connect Enterprise Certified Container Operator to version 12.0.21 or higher.
• Ensure all DesignerAuthoring, IntegrationServer, and IntegrationRuntime components are upgraded to version 12.0.12-r21 or higher.

No workarounds or alternative mitigations are provided, so upgrading to the fixed versions is the recommended immediate action.

Useful 0 Not Useful 0

How can this vulnerability impact me? :

This vulnerability can impact you by exposing sensitive data transmitted by IBM App Connect Enterprise Certified Container to interception by attackers.

• Attackers can perform man-in-the-middle attacks to capture unencrypted metrics data.
• This leads to a confidentiality breach, potentially exposing sensitive information.

The vulnerability has a CVSS v3.1 base score of 5.9, indicating a medium severity with high confidentiality impact but no impact on integrity or availability.

Useful 0 Not Useful 0