CVE-2025-2140
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.
Risk Assessment
An authenticated network user could send emails spoofing another sender's identity, potentially leading to phishing or misleading recipients.
Recommendation
Update IBM Engineering Requirements Management Doors Next to the latest patched version or apply vendor-recommended mitigations.
Other vulnerabilities in IBM Engineering Requirements Management Doors Next
See all- CVE-2025-33096Medium
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user to cause a denial of service by uploading specially crafted files using uncontrolled recursion.
- CVE-2025-2139Low
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users due to client-side enforcement of server-side security.
- CVE-2025-2138Low
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users due to client-side enforcement of server-side security.
Original NVD description (English source)
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS