CVE-2025-36187

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-36187", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:16:23.420Z", "datePublished": "2026-03-25T21:26:47.129Z", "dateUpdated": "2026-03-26T16:09:45.856Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-25T21:27:49.501Z"}, "title": "Multiple Security vulnerabilities affecting IBM Knowledge Catalog Standard Cartridge", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Knowledge Catalog Standard Cartridge", "versions": [{"status": "affected", "version": "5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1"}], "cpes": ["cpe:2.3:a:ibm:knowledge_catalog_standard_cartridge:5.0.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Knowledge Catalog Standard Cartridge 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1 stores potentially sensitive information in log files that could be read by a local privileged user.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Knowledge Catalog Standard Cartridge 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1 stores potentially sensitive information in log files that could be read by a local privileged user.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7267542", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "Affected Product(s)Version(s)IBM Knowledge Catalog Standard Cartridge5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><br></p><table><tbody><tr><td>Affected Product(s)</td><td>Version(s)</td></tr><tr><td>IBM Knowledge Catalog Standard Cartridge</td><td>5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1</td></tr></tbody></table>"}]}], "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T16:09:38.715873Z", "id": "CVE-2025-36187", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T16:09:45.856Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36187", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T16:09:38.715873Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T16:09:43.402Z"}}], "cna": {"title": "Multiple Security vulnerabilities affecting IBM Knowledge Catalog Standard Cartridge", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:knowledge_catalog_standard_cartridge:5.0.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Knowledge Catalog Standard Cartridge", "versions": [{"status": "affected", "version": "5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1"}]}], "solutions": [{"lang": "en", "value": "Affected Product(s)Version(s)IBM Knowledge Catalog Standard Cartridge5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1", "supportingMedia": [{"type": "text/html", "value": "<p><br></p><table><tbody><tr><td>Affected Product(s)</td><td>Version(s)</td></tr><tr><td>IBM Knowledge Catalog Standard Cartridge</td><td>5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1</td></tr></tbody></table>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7267542", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM Knowledge Catalog Standard Cartridge 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1 stores potentially sensitive information in log files that could be read by a local privileged user.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Knowledge Catalog Standard Cartridge 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1 stores potentially sensitive information in log files that could be read by a local privileged user.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-25T21:27:49.501Z"}}}, "cveMetadata": {"cveId": "CVE-2025-36187", "state": "PUBLISHED", "dateUpdated": "2026-03-26T16:09:45.856Z", "dateReserved": "2025-04-15T21:16:23.420Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-03-25T21:26:47.129Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:knowledge_catalog_standard_cartridge:5.0.0:*:*:*:*:*:*:*"], "product": "Knowledge Catalog Standard Cartridge", "vendor": "IBM", "versions": [{"status": "affected", "version": "5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:knowledge_catalog:5.0.0:*:*:*:standard:*:*:*", "matchCriteriaId": "82345B79-8BBE-4197-9C31-FF2D164EE23D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:knowledge_catalog:5.0.1:*:*:*:standard:*:*:*", "matchCriteriaId": "EB2B20F0-A084-4A05-BAAF-B04E974B8DA1", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:knowledge_catalog:5.0.2:*:*:*:standard:*:*:*", "matchCriteriaId": "2161D132-565C-452E-BBC4-DC9DC92E07FC", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:knowledge_catalog:5.0.3:*:*:*:standard:*:*:*", "matchCriteriaId": "59B73621-2D7A-473B-9EEA-5C62907A4EA1", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:knowledge_catalog:5.1:*:*:*:standard:*:*:*", "matchCriteriaId": "A4D72C2A-C79F-4695-865F-AEBC8E698D88", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:knowledge_catalog:5.1.1:*:*:*:standard:*:*:*", "matchCriteriaId": "CA8D4B80-6AD5-4A45-9292-7CA2C6D52E76", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:knowledge_catalog:5.1.2:*:*:*:standard:*:*:*", "matchCriteriaId": "331B44D0-10DB-4E40-B8B9-AD1F656D532E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:knowledge_catalog:5.1.3:*:*:*:standard:*:*:*", "matchCriteriaId": "F5EA3551-53AF-4A70-8976-6F564413C580", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:knowledge_catalog:5.2.0:*:*:*:standard:*:*:*", "matchCriteriaId": "5F267C03-F792-4FDD-9012-40B1F0388D26", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:knowledge_catalog:5.2.1:*:*:*:standard:*:*:*", "matchCriteriaId": "C0457945-C0E2-42FE-B2A0-618458FB7E9E", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:redhat:openshift:-:*:*:*:*:*:*:*", "matchCriteriaId": "22EB28CE-7C7F-4290-85FE-5E3EBF905CF0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Knowledge Catalog Standard Cartridge 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1 stores potentially sensitive information in log files that could be read by a local privileged user."}, {"lang": "es", "value": "IBM Knowledge Catalog Standard Cartridge 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1 almacena informaci\u00f3n potencialmente sensible en archivos de registro que podr\u00eda ser le\u00edda por un usuario privilegiado local."}], "id": "CVE-2025-36187", "lastModified": "2026-06-17T09:14:35.407", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36187", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T16:09:38.715873Z", "version": "2.0.3"}}]}, "published": "2026-03-25T22:16:19.090", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7267542"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5,1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.1.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.2.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Knowledge Catalog Standard Cartridge", "source": "cna", "vendor": "IBM"}, "product": "knowledge_catalog_standard_cartridge", "vendor": "ibm"}], "analysis": {"en": {"generated_at": "2026-04-01T05:27:48.250752+00:00", "value": {"mitigation_remediation": ["Upgrade IBM Knowledge Catalog Standard Cartridge to a version that fixes the log\u2011file access issue and remove the affected releases from deployment.", "If an upgrade cannot be applied immediately, restrict log file permissions to the minimal necessary services and eliminate sensitive data from the logs.", "Ensure that privileged accounts on the platform use least\u2011privilege principles and audit file access to detect unusual read operations.", "Consult IBM support or the provided IBM support page for the latest patch information and rollout guidance."], "summary": {"action": "Immediate update", "impact": "Sensitive information exposure via insecure log files"}, "threat_synthesis": {"affected_systems": "IBM Knowledge Catalog Standard Cartridge versions 5.0.0 through 5.2.1, including the standard cartridge component, are impacted. Users running any of these releases on IBM or Red\u202fHat OpenShift environments should be aware that log files are accessible to local administrators.", "description_and_impact": "A local privileged user can read log files created by IBM Knowledge Catalog Standard Cartridge that may contain confidential information, because those logs are written with inadequate access controls. The technical weakness is insecure logging (CWE\u2011532) and poses a data disclosure risk.", "risk_and_exploitability": "The CVSS score of 4.4 indicates a low to moderate severity, and the EPSS score of less than 1\u202f% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying it has not been broadly exploited yet. However, because the attacker only needs local privileged access, which is attainable on many systems, the potential data exposure is significant. Exploitation requires local administrative privileges and results in reading unwarranted log files."}}}}, "created": "2026-03-26T11:31:25.325848+00:00", "updated": "2026-04-02T07:59:02.629879+00:00", "vendors": ["ibm", "ibm$PRODUCT$knowledge_catalog_standard_cartridge"]}