CVE-2025-36075

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-36075", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:16:13.122Z", "datePublished": "2026-11-08T16:07:01.387Z", "dateUpdated": "2026-11-09T17:11:33.701Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-08T16:07:01.387Z"}, "title": "IBM Safer Payments could allow an authenticated user to obtain sensitive information", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1287", "description": "CWE-1287 Improper Validation of Specified Type of Input", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Safer Payments", "versions": [{"status": "affected", "version": "6.4.0.00", "lessThanOrEqual": "6.4.2.11", "versionType": "semver"}, {"status": "affected", "version": "6.5.0.00", "lessThanOrEqual": "6.5.0.09", "versionType": "semver"}, {"status": "affected", "version": "6.6.0.00", "lessThanOrEqual": "6.6.0.07", "versionType": "semver"}, {"status": "affected", "version": "6.7.0.00", "lessThanOrEqual": "6.7.0.03", "versionType": "semver"}, {"status": "affected", "version": "6.8.0.00", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7293213", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "Update IBM Safer Payments to version 6.4.2.12, 6.5.0.10, 6.6.0.08, 6.7.0.04, 6.8.0.01 or higher.\n\n\n\nRefer to the IBM Safer Payments documentation https://www.ibm.com/docs/en/safer-payments \u00a0to download the updates.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Update IBM Safer Payments to version 6.4.2.12, 6.5.0.10, 6.6.0.08, 6.7.0.04, 6.8.0.01 or higher.</p><p>Refer to the <a href=\"https://www.ibm.com/docs/en/safer-payments\" rel=\"nofollow\">IBM Safer Payments documentation</a>\u00a0to download the updates.</p>"}]}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ibm:safer_payments:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4.0.00", "versionEndIncluding": "6.4.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:a:ibm:safer_payments:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5.0.00", "versionEndIncluding": "6.5.0.09"}, {"vulnerable": true, "criteria": "cpe:2.3:a:ibm:safer_payments:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.0.00", "versionEndIncluding": "6.6.0.07"}, {"vulnerable": true, "criteria": "cpe:2.3:a:ibm:safer_payments:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.0.00", "versionEndIncluding": "6.7.0.03"}, {"vulnerable": true, "criteria": "cpe:2.3:a:ibm:safer_payments:6.8.0.00:*:*:*:*:*:*:*"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T17:10:51.462397Z", "id": "CVE-2025-36075", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:11:33.701Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36075", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T17:10:51.462397Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:11:29.606Z"}}], "cna": {"title": "IBM Safer Payments could allow an authenticated user to obtain sensitive information", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "IBM", "product": "Safer Payments", "versions": [{"status": "affected", "version": "6.4.0.00", "versionType": "semver", "lessThanOrEqual": "6.4.2.11"}, {"status": "affected", "version": "6.5.0.00", "versionType": "semver", "lessThanOrEqual": "6.5.0.09"}, {"status": "affected", "version": "6.6.0.00", "versionType": "semver", "lessThanOrEqual": "6.6.0.07"}, {"status": "affected", "version": "6.7.0.00", "versionType": "semver", "lessThanOrEqual": "6.7.0.03"}, {"status": "affected", "version": "6.8.0.00", "versionType": "semver"}]}], "solutions": [{"lang": "en", "value": "Update IBM Safer Payments to version 6.4.2.12, 6.5.0.10, 6.6.0.08, 6.7.0.04, 6.8.0.01 or higher.\n\n\n\nRefer to the IBM Safer Payments documentation https://www.ibm.com/docs/en/safer-payments \u00a0to download the updates.", "supportingMedia": [{"type": "text/html", "value": "<p>Update IBM Safer Payments to version 6.4.2.12, 6.5.0.10, 6.6.0.08, 6.7.0.04, 6.8.0.01 or higher.</p><p>Refer to the <a href=\"https://www.ibm.com/docs/en/safer-payments\" rel=\"nofollow\">IBM Safer Payments documentation</a>\u00a0to download the updates.</p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7293213", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en", "value": "IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1287", "description": "CWE-1287 Improper Validation of Specified Type of Input"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:safer_payments:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "6.4.2.11", "versionStartIncluding": "6.4.0.00"}, {"criteria": "cpe:2.3:a:ibm:safer_payments:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "6.5.0.09", "versionStartIncluding": "6.5.0.00"}, {"criteria": "cpe:2.3:a:ibm:safer_payments:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "6.6.0.07", "versionStartIncluding": "6.6.0.00"}, {"criteria": "cpe:2.3:a:ibm:safer_payments:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "6.7.0.03", "versionStartIncluding": "6.7.0.00"}, {"criteria": "cpe:2.3:a:ibm:safer_payments:6.8.0.00:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-08T16:07:01.387Z"}}}, "cveMetadata": {"cveId": "CVE-2025-36075", "state": "PUBLISHED", "dateUpdated": "2026-11-09T17:11:33.701Z", "dateReserved": "2025-04-15T21:16:13.122Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-11-08T16:07:01.387Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Safer Payments", "vendor": "IBM", "versions": [{"lessThanOrEqual": "6.4.2.11", "status": "affected", "version": "6.4.0.00", "versionType": "semver"}, {"lessThanOrEqual": "6.5.0.09", "status": "affected", "version": "6.5.0.00", "versionType": "semver"}, {"lessThanOrEqual": "6.6.0.07", "status": "affected", "version": "6.6.0.00", "versionType": "semver"}, {"lessThanOrEqual": "6.7.0.03", "status": "affected", "version": "6.7.0.00", "versionType": "semver"}, {"status": "affected", "version": "6.8.0.00", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information."}, {"lang": "es", "value": "IBM Safer Payments 6.4.0.00 hasta la versi\u00f3n 6.4.2.11 incluida, 6.5.0.00 hasta la versi\u00f3n 6.5.0.09 incluida, 6.6.0.00 hasta la versi\u00f3n 6.6.0.07 incluida, 6.7.0.00 hasta la versi\u00f3n 6.7.0.03 incluida, y 6.8.0.00 podr\u00eda permitir a un usuario autenticado obtener informaci\u00f3n sensible, causado por una validaci\u00f3n de entrada de usuario incorrecta. Mediante el uso de un conjunto de solicitudes de API, el usuario podr\u00eda explotar esta vulnerabilidad para descifrar informaci\u00f3n sensible."}], "id": "CVE-2025-36075", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36075", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T17:10:51.462397Z", "version": "2.0.3"}}]}, "published": "2026-11-08T16:16:35.930", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7293213"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1287"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.4.0.00,6.4.2.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.5.0.00,6.5.0.09]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.6.0.00,6.6.0.07]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.7.0.00,6.7.0.03]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8.0.00"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Safer Payments", "source": "cna", "vendor": "IBM"}, "product": "safer_payments", "vendor": "ibm"}], "created": "2026-11-08T17:30:15.807876+00:00", "updated": "2026-11-08T17:45:07.839043+00:00", "vendors": ["ibm", "ibm$PRODUCT$safer_payments"]}