CVE-2025-2138
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users due to client-side enforcement of server-side security.
Risk Assessment
An authenticated user can delete other users' comments, potentially leading to loss of important information, disruption of collaboration, and data integrity violations.
Recommendation
Move access control enforcement to the server side and upgrade to the latest version of the product.
Other vulnerabilities in IBM Engineering Requirements Management Doors Next
See all- CVE-2025-33096Medium
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user to cause a denial of service by uploading specially crafted files using uncontrolled recursion.
- CVE-2025-2140Medium
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.
- CVE-2025-2139Low
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users due to client-side enforcement of server-side security.
Original NVD description (English source)
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users due to client-side enforcement of server-side security.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS