CVE-2025-33096
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user to cause a denial of service by uploading specially crafted files using uncontrolled recursion.
Risk Assessment
An authenticated user could cause application unavailability, disrupting engineering teams. This may lead to project delays and financial losses.
Recommendation
Update IBM Engineering Requirements Management Doors Next to the latest version and restrict file upload capabilities for users.
Other vulnerabilities in IBM Engineering Requirements Management Doors Next
See all- CVE-2025-2140Medium
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.
- CVE-2025-2139Low
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users due to client-side enforcement of server-side security.
- CVE-2025-2138Low
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users due to client-side enforcement of server-side security.
Original NVD description (English source)
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user to cause a denial of service by uploading specially crafted files using uncontrolled recursion.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS