CVE-2025-36003
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
IBM Security Verify Governance Identity Manager 10.0.2 may return detailed technical error messages that disclose sensitive system information. A remote attacker could use this information in further attacks against the system.
Risk Assessment
Disclosure of technical details helps attackers fingerprint the environment and plan subsequent attack stages. This may increase the risk of successful exploitation of other vulnerabilities.
Recommendation
Disable detailed error messages in production and apply the update or mitigation recommended by IBM. Restrict access to administrative interfaces.
Other vulnerabilities in IBM Security Verify Governance Identity Manager
See all- CVE-2023-35019High
IBM Security Verify Governance, Identity Manager 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.
- CVE-2023-35016Medium
IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing 'dot dot' sequences (/../) to view arbitrary files on the system.
Original NVD description (English source)
IBM Security Verify Governance Identity Manager 10.0.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks against the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS