CVE-2025-14810
Insufficient Session Expiration in IBM InfoSphere Allows Data Access
Publication date: 2026-03-25
Last updated on: 2026-03-26
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | infosphere_information_server | From 11.7.0.0 (inc) to 11.7.1.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-613 | According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection methods or commands provided to identify this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate step to mitigate this vulnerability is to apply the fixes provided by IBM through APAR DT458476.
Users should upgrade IBM InfoSphere Information Server to versions 11.7.1.0, 11.7.1.6, or 11.7.1.6 Service Pack 2 to address the vulnerability.
No workarounds or other mitigations are currently available.
Can you explain this vulnerability to me?
CVE-2025-14810 is a vulnerability in IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 caused by insufficient session expiration. Specifically, the system does not invalidate user sessions after their privileges have been modified. This means that an authenticated user can retain access to sensitive information even after their access rights have been changed or reduced.
The vulnerability is classified under CWE-613 (Insufficient Session Expiration) and has a CVSS v3.1 base score of 6.3, indicating a moderate severity. It can be exploited remotely over the network with low attack complexity, requiring low privileges and no user interaction.
How can this vulnerability impact me? :
This vulnerability can allow an authenticated user to retain access to sensitive information even after their privileges have been modified or revoked. This means that unauthorized access to confidential data could persist, potentially leading to data leakage or misuse.
The impact affects confidentiality, integrity, and availability to a limited extent, as indicated by the CVSS vector. An attacker could exploit this flaw to continue accessing or manipulating data they should no longer have permission to use.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not explicitly address how the vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.