CVE-2025-36160CWE-497

CVE-2025-36160

Medium · published November 21, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
18.5
In the wild
Unconfirmed
What it is

IBM Concert 1.0.0 through 2.0.0 could disclose sensitive server information from HTTP response headers that could aid in further attacks against the system.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00272 · 18.5th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2025-11-21T03:15Z
Affected products (1)
ProductVersionsFixed in
ibm/concert≥ 1.0.0, < 2.1.02.1.0
References (1)
https://www.ibm.com/support/pages/node/7252019 · [email protected]
EPSS history
Timeline
  • 20 NOV 21:15Z
    IBM Concert Information Disclosure
    cvelistv5