Vulnerability-Lookup

FKIE_CVE-2025-36033

Vulnerability from fkie_nvd - Published: 2026-02-03 23:16 - Updated: 2026-06-17 09:14

Severity

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 through 7.1.0 Interim Fix 004 IBM Global Configuration Management is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

References

	URL	Tags
	psirt@us.ibm.com	https://www.ibm.com/support/pages/node/7258063	Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.0.3
ibm	engineering_lifecycle_management	7.1.0
ibm	engineering_lifecycle_management	7.1.0
ibm	engineering_lifecycle_management	7.1.0
ibm	engineering_lifecycle_management	7.1.0
ibm	engineering_lifecycle_management	7.1.0
ibm	engineering_lifecycle_management	7.1.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:engineering_lifecycle_management___global_configuration_management:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:engineering_lifecycle_management___global_configuration_management:7.0.3:interim_fix_017:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:engineering_lifecycle_management___global_configuration_management:7.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:engineering_lifecycle_management___global_configuration_management:7.1.0:interim_fix_004:*:*:*:*:*:*"
          ],
          "product": "Engineering Lifecycle Management - Global Configuration Management",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "7.0.3 Interim Fix 017",
              "status": "affected",
              "version": "7.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.0 Interim Fix 004",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:-:*:*:*:*:*:*",
              "matchCriteriaId": "BA0582EF-251B-4694-8B17-EC0F70F10801",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:ifix002:*:*:*:*:*:*",
              "matchCriteriaId": "209A6B2B-A3CE-4F5F-B1D0-36228625005D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:ifix003:*:*:*:*:*:*",
              "matchCriteriaId": "8449CFAE-05C3-4212-AE0F-7B82E588D8A2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:ifix004:*:*:*:*:*:*",
              "matchCriteriaId": "1C68C005-C09B-427B-9206-F1CA70F72EE5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:ifix005:*:*:*:*:*:*",
              "matchCriteriaId": "D712BB02-8954-4F1A-9940-7E547342410B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:ifix006:*:*:*:*:*:*",
              "matchCriteriaId": "32B14BF7-43A6-4979-A3AD-369034486EFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:ifix007:*:*:*:*:*:*",
              "matchCriteriaId": "7DD02B82-C06B-4D2A-B8B8-633C8AE208EB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:ifix008:*:*:*:*:*:*",
              "matchCriteriaId": "62D0DE8D-0986-4B04-972E-71053995C1CC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:ifix009:*:*:*:*:*:*",
              "matchCriteriaId": "7F83533F-043F-4073-A883-27A2834D6130",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:ifix010:*:*:*:*:*:*",
              "matchCriteriaId": "34427171-70E0-474E-80DD-BDF46135CE4A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:ifix011:*:*:*:*:*:*",
              "matchCriteriaId": "30B2FA43-5684-4A6B-9A5D-879E42C1A8B7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:ifix012:*:*:*:*:*:*",
              "matchCriteriaId": "EA376C3C-8509-4342-A54B-A21F031BF6C1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:ifix013:*:*:*:*:*:*",
              "matchCriteriaId": "4C7B4708-5BB9-4BB9-BEB4-8574F2872DA5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:ifix014:*:*:*:*:*:*",
              "matchCriteriaId": "5B839BEE-17AB-4776-B5F5-443E07CC6A18",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:ifix015:*:*:*:*:*:*",
              "matchCriteriaId": "42093B36-DC7E-41D8-B846-A943DD576FDD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:ifix016:*:*:*:*:*:*",
              "matchCriteriaId": "2795CBD8-0F0B-4347-8499-33062AC0ED80",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3:ifix017:*:*:*:*:*:*",
              "matchCriteriaId": "39161861-4C6F-4F6C-961F-5FD142999AA8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.1.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "EA9D4742-2C27-4515-86D8-69A2C8EF2910",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.1.0:ifix001:*:*:*:*:*:*",
              "matchCriteriaId": "6BE1B8B4-40CB-4B72-B71B-D321B0CD4CAA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.1.0:ifix0010:*:*:*:*:*:*",
              "matchCriteriaId": "2D3B600B-3677-4168-8A7C-E6A330F3D85B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.1.0:ifix002:*:*:*:*:*:*",
              "matchCriteriaId": "05AE7D18-38B4-4326-9A48-7B1BB4C72EC7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.1.0:ifix003:*:*:*:*:*:*",
              "matchCriteriaId": "15181084-D833-4777-836C-8E0CCE53342F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:engineering_lifecycle_management:7.1.0:ifix004:*:*:*:*:*:*",
              "matchCriteriaId": "FDBAD00C-2DD4-4A13-B89E-55940B1598CB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 through 7.1.0 Interim Fix 004 IBM Global Configuration Management is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
    },
    {
      "lang": "es",
      "value": "IBM Engineering Lifecycle Management - Gesti\u00f3n de Configuraci\u00f3n Global 7.0.3 hasta 7.0.3 Interim Fix 017, y 7.1.0 hasta 7.1.0 Interim Fix 004 IBM Gesti\u00f3n de Configuraci\u00f3n Global es vulnerable a cross-site scripting. Esta vulnerabilidad permite a un usuario autenticado incrustar c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, alterando as\u00ed la funcionalidad prevista, lo que podr\u00eda llevar a la divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n de confianza."
    }
  ],
  "id": "CVE-2025-36033",
  "lastModified": "2026-06-17T09:14:23.887",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-36033",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-02-04T14:50:14.106067Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-02-03T23:16:05.620",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7258063"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "psirt@us.ibm.com",
      "type": "Secondary"
    }
  ]
}

CVE-2025-36033 (GCVE-0-2025-36033)

Vulnerability from cvelistv5 – Published: 2026-02-03 22:12 – Updated: 2026-02-04 14:50

Title

IBM Engineering Lifecycle Management - Global Configuration Management is vulnerable to cross-site scripting

Summary

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-04 14:50 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ibm mitre root

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7258063	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version
IBM	Engineering Lifecycle Management - Global Configuration Management	Affected: 7.0.3 , ≤ 7.0.3 Interim Fix 017 (semver) Affected: 7.1.0 , ≤ 7.1.0 Interim Fix 004 (semver) cpe:2.3:a:ibm:engineering_lifecycle_management___global_configuration_management:7.0.3:::::::* cpe:2.3:a:ibm:engineering_lifecycle_management___global_configuration_management:7.0.3:interim_fix_017:::::: cpe:2.3:a:ibm:engineering_lifecycle_management___global_configuration_management:7.1.0:::::::* cpe:2.3:a:ibm:engineering_lifecycle_management___global_configuration_management:7.1.0:interim_fix_004::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-36033",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-04T14:50:14.106067Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-04T14:50:34.015Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:engineering_lifecycle_management___global_configuration_management:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:engineering_lifecycle_management___global_configuration_management:7.0.3:interim_fix_017:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:engineering_lifecycle_management___global_configuration_management:7.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:engineering_lifecycle_management___global_configuration_management:7.1.0:interim_fix_004:*:*:*:*:*:*"
          ],
          "product": "Engineering Lifecycle Management - Global Configuration Management",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "7.0.3 Interim Fix 017",
              "status": "affected",
              "version": "7.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.0 Interim Fix 004",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 through 7.1.0 Interim Fix 004 IBM Global Configuration Management is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.\u003c/p\u003e"
            }
          ],
          "value": "IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 through 7.1.0 Interim Fix 004 IBM Global Configuration Management is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-03T22:12:36.858Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7258063"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now by upgrading to iFixes detailed below:\u003c/p\u003e\u003cp\u003eIBM recommends customers on ELM 7.0.1, 7.0.2 or any version below 7.0.3 to upgrade your products to Maintenance release 7.0.3 and apply below fix.\u003c/p\u003e\u003cp\u003eOptionally, upgrade to the latest 7.2.0 version.\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eAffected Product(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fix/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eIBM Engineering Lifecycle Management - Jazz Foundation\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e7.0.3\u003c/td\u003e\u003ctd\u003eDownload and install \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Engineering\u0026amp;product=ibm/Rational/IBM+Engineering+Lifecycle+Management\u0026amp;release=7.0.3\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=7.0.3-IBM-ELM-iFix018\u0026amp;includeRequisites=0\u0026amp;includeSupersedes=0\u0026amp;downloadMethod=ddp\"\u003eiFix018\u003c/a\u003e\u0026nbsp;or later\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eIBM Engineering Lifecycle Management - Jazz Foundation\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e7.1.0\u003c/td\u003e\u003ctd\u003eDownload and install \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Engineering\u0026amp;product=ibm/Rational/IBM+Engineering+Lifecycle+Management\u0026amp;release=7.1\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=7.1-IBM-ELM-iFix005\u0026amp;includeRequisites=1\u0026amp;includeSupersedes=0\u0026amp;downloadMethod=ddp\"\u003eiFix005\u003c/a\u003e\u0026nbsp;or later\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability now by upgrading to iFixes detailed below:\n\nIBM recommends customers on ELM 7.0.1, 7.0.2 or any version below 7.0.3 to upgrade your products to Maintenance release 7.0.3 and apply below fix.\n\nOptionally, upgrade to the latest 7.2.0 version.\n\nAffected Product(s)Version(s)Remediation/Fix/InstructionsIBM Engineering Lifecycle Management - Jazz Foundation\n\n7.0.3Download and install  iFix018 https://www.ibm.com/support/fixcentral/swg/downloadFixes \u00a0or laterIBM Engineering Lifecycle Management - Jazz Foundation\n\n7.1.0Download and install  iFix005 https://www.ibm.com/support/fixcentral/swg/downloadFixes \u00a0or later"
        }
      ],
      "title": "IBM Engineering Lifecycle Management - Global Configuration Management is vulnerable to cross-site scripting",
      "x_generator": {
        "engine": "ibm-cvegen"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2025-36033",
    "datePublished": "2026-02-03T22:12:29.853Z",
    "dateReserved": "2025-04-15T21:16:09.684Z",
    "dateUpdated": "2026-02-04T14:50:34.015Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.