CVE-2025-1350
MediumCVSS 5.3Summary
IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.
Risk Assessment
The disclosed information could be used in further attacks against the system, aiding the attacker in further exploitation.
Recommendation
Update IBM Controller to a version containing the fix. Until patched, disable detailed error messages in production environments.
Other vulnerabilities in IBM Controller
See all- CVE-2025-36421Medium
IBM Controller (versions 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1) transmits data in clear text, allowing an attacker to obtain sensitive information using man-in-the-middle techniques.
- CVE-2025-36178Medium
IBM Controller (versions 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1) could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size.
Original NVD description (English source)
IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.