CVE-2025-36351

MediumCVSS 4.3

Published: 29/09/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

13th percentile - higher than 13% of all known CVEs

Summary

IBM License Metric Tool 9.2.0 through 9.2.40 could allow an authenticated user to bypass access controls in the REST API interface and perform unauthorized actions.

Risk Assessment

An authenticated low-privileged user could perform operations they should not have access to, potentially compromising data confidentiality and integrity.

Recommendation

Update IBM License Metric Tool to a version newer than 9.2.40 that contains the security fix.

Other vulnerabilities in IBM License Metric Tool

CVE-2025-36352Medium
IBM License Metric Tool 9.2.0 through 9.2.40 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Original NVD description (English source)

IBM License Metric Tool 9.2.0 through 9.2.40 could allow an authenticated user to bypass access controls in the REST API interface and perform unauthorized actions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS