CVE-2025-3355
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Risk Assessment
A remote attacker can access sensitive files on the system, potentially leading to a breach of data confidentiality.
Recommendation
Upgrade IBM Tivoli Monitoring to a version later than 6.3.0.7 Service Pack 21. Implement input validation and restrict access to the system from untrusted networks.
Other vulnerabilities in IBM Tivoli Monitoring
See all- CVE-2015-5003High
The portal in IBM Tivoli Monitoring (ITM) versions 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 before FP7 allows remote authenticated users to execute arbitrary commands by leveraging Take Action view authority and providing crafted input.
- CVE-2014-6141High
IBM Tivoli Monitoring (ITM) versions 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, 6.2.3 through FP05, and 6.3.0 before FP04 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands by leveraging Take Action view authority to modify in-progress commands.
- CVE-2025-3356High
IBM Tivoli Monitoring versions 6.3.0.7 through 6.3.0.7 Service Pack 21 allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view, overwrite, or append to arbitrary files on the system.
Original NVD description (English source)
IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS