PT-2025-49590 · Ibm · Ibm Websphere Application Server+1

Published 2025-12-08 · Updated 2025-12-09 · CVE-2025-12635

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 8.5 and 9.0 IBM WebSphere Application Server Liberty versions 17.0.0.3 through 25.0.0.12

Description The software is susceptible to cross-site scripting due to insufficient validation of user-provided input. An attacker could leverage this issue by crafting a malicious URL designed to redirect a user to a harmful website.

Recommendations IBM WebSphere Application Server versions 8.5 and 9.0 should be updated. IBM WebSphere Application Server Liberty versions 17.0.0.3 through 25.0.0.12 should be updated.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-12635

Affected Products

Ibm Websphere Application Server

Ibm Websphere Application Server Liberty

References · 8

• https://osv.dev/vulnerability/CVE-2025-12635 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12635 · Security Note
• https://twitter.com/CVEnew/status/1998154707114623453 · Twitter Post
• https://ibm.com/support/pages/node/7254078 · Patch, Vendor Advisory
• https://twitter.com/knaepp/status/1998057519004938570 · Twitter Post
• https://twitter.com/knaepp/status/1998125441236799973 · Twitter Post
• https://twitter.com/knaepp/status/1998058765648588959 · Twitter Post
• https://twitter.com/knaepp/status/1998216037922148467 · Twitter Post