CVE-2025-2140CWE-346

CVE-2025-2140

Medium · published October 12, 2025

CVSS v3.1
5.7
EPSS
0%
Percentile
2.0
In the wild
Unconfirmed
What it is

IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00124 · 2.0th percentile
Weakness
CWE-346 · Origin Validation Error
Published
2025-10-12T18:15Z
Affected products (3)
ProductVersionsFixed in
ibm/engineering_requirements_management_doors_nextall versions—
ibm/engineering_requirements_management_doors_nextall versions—
ibm/engineering_requirements_management_doors_nextall versions—
References (1)
https://www.ibm.com/support/pages/node/7247716 · [email protected]
EPSS history
Timeline
  • 12 OCT 13:33Z
    IBM Engineering Requirements Management Doors Next spoofing
    cvelistv5