CVE-2025-27367
IBM OpenPages with Watson improper input validation
is vulnerable to improper input validation due to bypassing of client-side validation for the data types and requiredness of fields for GRC Objects when an authenticated user sends a specially crafted payload to the server allowing for data to be saved without storing the required fields.
Affected Products
-
CVE record
-
NVD configurations
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| IBM | OpenPages with Watson | unaffected |
|
Configuration 1 [-]
| AND |
|
No data.
No data available yet.
Remediation
Vendor Solution
For IBM OpenPages 9.0 - Apply 9.0 FixPack 5 (9.0.0.5) - Then Apply 9.0.0.5 Interim Fix 3 (9.0.0.5.3) Download URL for 9.0.0.5 - https://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-5 Download URL for 9.0.0.5.3 - https://www.ibm.com/support/pages/ibm-openpages-9005-interim-fix-3 For IBM OpenPages 8.3 - Apply 8.3 FixPack 3 (8.3.0.3) - Then Apply 8.3.0.3 Interim Fix 2 (8.3.0.3.2) Download URL for 8.3.0.3 - https://www.ibm.com/support/pages/openpages-watson-83-fix-pack-3 Download URL for 8.3.0.3.2 - https://www.ibm.com/support/pages/ibm-openpages-8303-interim-fix-2
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-20684 | IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to improper input validation due to bypassing of client-side validation for the data types and requiredness of fields for GRC Objects when an authenticated user sends a specially crafted payload to the server allowing for data to be saved without storing the required fields. |
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity High
Privileges Required Low
Scope Unchanged
Confidentiality Impact None
Integrity Impact High
Availability Impact None
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.277% probability within 30 days)
Exploitation none
Automatable no
Technical Impact partial
| Link | Providers |
|---|---|
| https://www.ibm.com/support/pages/node/7239155 |
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel Microsoft Microsoft windows |
|
| CPEs | cpe:2.3:a:ibm:openpages_with_watson:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* |
|
| Vendors & Products |
Linux
Linux linux Kernel Microsoft Microsoft windows |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to improper input validation due to bypassing of client-side validation for the data types and requiredness of fields for GRC Objects when an authenticated user sends a specially crafted payload to the server allowing for data to be saved without storing the required fields. | |
| Title | IBM OpenPages with Watson improper input validation | |
| First Time appeared |
Ibm
Ibm openpages With Watson |
|
| Weaknesses | CWE-602 | |
| CPEs | cpe:2.3:a:ibm:openpages_with_watson:8.3:*:*:*:*:*:*:* cpe:2.3:a:ibm:openpages_with_watson:9.0:*:*:*:*:*:*:* |
|
| Vendors & Products |
Ibm
Ibm openpages With Watson |
|
| References |
| |
| Metrics |
cvssV3_1
|
