PT-2025-17301 · Ibm · Ibm I+1

Glenn Robbers · Published 2025-04-18 · Updated 2025-07-04 · CVE-2025-2950

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.5

Description The issue is caused by improper neutralization of HTTP header content by IBM Navigator for i, allowing an authenticated user to manipulate the host header in HTTP requests. This can lead to changing the domain/IP address, resulting in unexpected behavior.

Recommendations For IBM i versions 7.3 through 7.5, consider restricting access to the IBM Navigator for i to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the host header in HTTP requests to the affected IBM Navigator for i until the issue is resolved.

Fix

Weakness Enumeration

CWE-644

Related Identifiers

BDU:2025-05153

CVE-2025-2950

Affected Products

Ibm Navigator For I

Ibm I

References · 6

• https://bdu.fstec.ru/vul/2025-05153 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-2950 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2950 · Vendor Advisory
• https://ibm.com/support/pages/node/7231320 · Vendor Advisory, Patch
• https://twitter.com/dailycve/status/1940957244906262887 · Twitter Post
• https://twitter.com/CVEnew/status/1913312941459595576 · Twitter Post