CVE-2025-3356CWE-22path-traversal

CVE-2025-3356

High Β· published October 31, 2025

CVSS v3.1
8.6
EPSS
0%
Percentile
35.6
In the wild
Unconfirmed
What it is

⚑ A sneaky directory traversal vulnerability is lurking in IBM Tivoli Monitoring! Just a crafted URL could let attackers peek intoβ€”or even mess withβ€”your files! 🚨 Think of it like a delivery driver following an incorrect address on a package, leading straight into your storage room instead of the front office. With the right 'dot dot' sequences, the attacker can navigate through directories unchecked! This vulnerability could allow an attacker to gain unauthorized access to sensitive files on your system, overwrite them, or append data without permission. If exploited, this could lead to data breaches or manipulation, making it a serious threat to your data integrity!

Put simply

Think of it like a delivery driver following an incorrect address on a package, leading straight into your storage room instead of the front office. With the right 'dot dot' sequences, the attacker can navigate through directories unchecked! The CVE-2025-3356 vulnerability exists in IBM Tivoli Monitoring versions 6.3.0.7 through Service Pack 21, allowing attackers to traverse directories by exploiting crafted URL requests containing '../' sequences.

What to do

This vulnerability could allow an attacker to gain unauthorized access to sensitive files on your system, overwrite them, or append data without permission. If exploited, this could lead to data breaches or manipulation, making it a serious threat to your data integrity! Immediate action is required! Ensure you're running the latest patched version of IBM Tivoli Monitoring. Review your URL handling and security configurations to prevent directory traversal attacks, and consider implementing strict input validation. You've got this! By taking these steps, you're one step closer to securing your system. πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
8.6 Β· HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00424 Β· 35.6th percentile
Weakness
CWE-22 Β· Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-10-31T00:15Z
Affected products (22)
ProductVersionsFixed in
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
ibm/tivoli_monitoringall versionsβ€”
References (1)
EPSS history
Timeline
  • 30 OCT 19:22Z
    IBM Tivoli Monitoring is vulnerable to unauthenticated file read and write operations
    cvelistv5