CVE-2025-64649
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
IBM Concert versions 1.0.0 through 2.3.1 may allow a remote attacker to perform unauthorized actions using man-in-the-middle techniques due to improper certificate validation.
Risk Assessment
An attacker could intercept and modify communications, potentially leading to data integrity compromise and unauthorized access to the system.
Recommendation
Update IBM Concert to the latest available version that includes certificate validation fixes. Additionally, configure the system to enforce proper TLS certificate verification.
Other vulnerabilities in IBM Concert
See all- CVE-2025-33015High
IBM Concert versions 1.0.0 through 2.1.0 is vulnerable to malicious file upload due to lack of content validation for files uploaded to the web interface. An attacker could exploit this to upload harmful files.
- CVE-2026-3627Critical
IBM Concert versions 1.0.0 through 2.3.1 are vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, potentially allowing viewing, adding, modifying, or deleting information in the back-end database.
- CVE-2025-13044Medium
IBM Concert versions 1.0.0 through 2.2.0 creates temporary files with predictable names. A local user can exploit a symlink attack to overwrite arbitrary files.
Original NVD description (English source)
IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation.