CVE-2025-3355CWE-22path-traversal

CVE-2025-3355

High · published October 31, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

🚨 A crafty URL can expose sensitive files on your system! This vulnerability in IBM Tivoli Monitoring lets attackers use "dot dot" sequences to traverse directories and peek at files they shouldn’t. ⚡ Think of your system like a library with secret rooms. An attacker is like a sneaky patron who discovers a way to access restricted sections simply by using a hidden passage they found — all because the front desk didn’t check their ID properly! An attacker armed with this vulnerability could access sensitive files, potentially revealing confidential information, configurations, or even credentials. This kind of access could lead to unauthorized actions or data breaches, making it a serious concern for system integrity.

Put simply

Think of your system like a library with secret rooms. An attacker is like a sneaky patron who discovers a way to access restricted sections simply by using a hidden passage they found — all because the front desk didn’t check their ID properly! CVE-2025-3355 allows remote attackers to exploit directory traversal by sending specially crafted URL requests containing "../" sequences, which enable them to navigate the file system and access arbitrary files.

What to do

An attacker armed with this vulnerability could access sensitive files, potentially revealing confidential information, configurations, or even credentials. This kind of access could lead to unauthorized actions or data breaches, making it a serious concern for system integrity. To remediate this vulnerability, you should update IBM Tivoli Monitoring to the latest version immediately. Also, consider implementing stricter access controls and input validation to block such traversal attempts. You've got this! Follow these steps, and you'll be on your way to securing your system in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00529 · 43.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-10-31T00:15Z
Affected products (22)
ProductVersionsFixed in
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
ibm/tivoli_monitoringall versions—
References (1)
EPSS history
Timeline
  • 30 OCT 19:21Z
    IBM Tivoli Monitoring is vulnerable to unauthenticated file read and write operations
    cvelistv5