CVE-2025-36187
Information Disclosure in IBM Knowledge Catalog Logs via Local Access
Publication date: 2026-03-25
Last updated on: 2026-03-31
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | knowledge_catalog | 5.0.0 |
| ibm | knowledge_catalog | 5.0.1 |
| ibm | knowledge_catalog | 5.0.2 |
| ibm | knowledge_catalog | 5.0.3 |
| ibm | knowledge_catalog | 5.1 |
| ibm | knowledge_catalog | 5.1.1 |
| ibm | knowledge_catalog | 5.1.2 |
| ibm | knowledge_catalog | 5.1.3 |
| ibm | knowledge_catalog | 5.2.0 |
| ibm | knowledge_catalog | 5.2.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in IBM Knowledge Catalog Standard Cartridge versions 5.0.0 through 5.2.1. It involves the storage of potentially sensitive information in log files. These log files can be accessed and read by a local user who has privileged access to the system.
How can this vulnerability impact me? :
The impact of this vulnerability is that a local privileged user could gain access to sensitive information stored in log files. This could lead to unauthorized disclosure of confidential data, potentially compromising the security and privacy of the system or its users.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves IBM Knowledge Catalog Standard Cartridge versions 5.0.0 through 5.2.1 storing potentially sensitive information in log files accessible to local privileged users.
This exposure of sensitive information in logs could potentially impact compliance with standards and regulations such as GDPR and HIPAA, which require protection of sensitive data and restrict unauthorized access.
However, specific effects on compliance or mitigation measures are not detailed in the provided information.