Executive Summary

CVE-2025-14974 is an Insecure Direct Object Reference (IDOR) vulnerability affecting IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6.

This vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key, meaning that an attacker with low privileges can access objects or data they should not be authorized to access by manipulating references to those objects.

The vulnerability has a CVSS v3.1 base score of 5.7, indicating a moderate severity with a high impact on confidentiality but no impact on integrity or availability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with low privileges on an adjacent network to access sensitive information that they should not be authorized to see, leading to a high confidentiality impact.

There is no impact on data integrity or system availability, but unauthorized disclosure of sensitive data could lead to information leakage.

Because the attack requires low privileges and no user interaction, it could be exploited relatively easily in environments where the attacker has some network access.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2025-14974 vulnerability in IBM InfoSphere Information Server, you should apply the fixes provided via APAR DT458648.

Upgrade your IBM InfoSphere Information Server to one of the following versions: 11.7.1.0, 11.7.1.6, or apply the 11.7.1.6 Service Pack 2.

Note that no workarounds or alternative mitigations are provided, so applying the official fixes or upgrading is the recommended immediate action.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability is an Insecure Direct Object Reference (IDOR) with a high confidentiality impact, which could potentially expose sensitive data.

However, the provided information does not explicitly discuss how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0