PT-2025-5798 · Ibm · Ibm App Connect Enterprise

Published 2025-02-04 · Updated 2025-08-12 · CVE-2025-0799

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions IBM App Connect enterprise versions 12.0.1.0 through 12.0.12.10 IBM App Connect enterprise versions 13.0.1.0 through 13.0.2.1

Description The issue allows an authenticated user to write to an arbitrary file on the system during bar configuration deployment due to improper pathname limitations on restricted directories.

Recommendations For IBM App Connect enterprise versions 12.0.1.0 through 12.0.12.10, consider restricting access to the bar configuration deployment feature until a patch is available. For IBM App Connect enterprise versions 13.0.1.0 through 13.0.2.1, consider restricting access to the bar configuration deployment feature until a patch is available. As a temporary workaround, consider implementing additional pathname limitations on restricted directories to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-02304

CVE-2025-0799

Affected Products

Ibm App Connect Enterprise

References · 9

• https://ibm.com/support/pages/node/7182418 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-0799 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02304 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-0799 · Security Note
• https://t.me/cveNotify/131915 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1887327262359302639 · Twitter Post
• https://t.me/cvenotify/110206 · Telegram Post
• https://t.me/cvedetector/17357 · Telegram Post
• https://twitter.com/CVEnew/status/1887305130070188154 · Twitter Post