PT-2025-39829 · Ibm · Ibm License Metric Tool

Published 2025-09-29 · Updated 2025-09-29 · CVE-2025-36351

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM License Metric Tool versions 9.2.0 through 9.2.40

Description An authenticated user can bypass access controls within the REST API interface, potentially leading to unauthorized actions. The issue relates to access control within the REST API. The API endpoint allows bypassing of intended security measures.

Recommendations Update to a version later than 9.2.40.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-16245

CVE-2025-36351

Affected Products

Ibm License Metric Tool

References · 7

• https://osv.dev/vulnerability/CVE-2025-36351 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16245 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-36351 · Security Note
• https://ibm.com/support/pages/node/7246534 · Patch, Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1972692796629729702 · Twitter Post
• https://twitter.com/CVEnew/status/1972676009708142632 · Twitter Post
• https://t.me/CVEtracker/33630 · Telegram Post