{"id":"CVE-2025-13044","state":"PUBLISHED","title":"Multiple Vulnerabilities in IBM Concert Software","description":"IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.","publishedAt":"2026-04-07T01:07:38.740Z","updatedAt":"2026-04-07T16:24:57.410Z","severity":{"score":6.2,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"ibm"},"assigner":"ibm","products":["IBM Concert"],"affected":[{"vendor":"IBM","product":"Concert","versions":[{"version":"1.0.0","status":"affected","lessThanOrEqual":"2.2.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:concert:2.2.0:*:*:*:*:*:*:*"]}],"references":["https://www.ibm.com/support/pages/node/7268620"],"weaknesses":["CWE-340"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/13xxx/CVE-2025-13044.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-13044","state":"PUBLISHED","datePublished":"2026-04-07T01:07:38.740Z","dateUpdated":"2026-04-07T16:24:57.410Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2025-11-11T22:42:06.302Z"},"containers":{"cna":{"title":"Multiple Vulnerabilities in IBM Concert Software","descriptions":[{"lang":"en","value":"IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack."}],"affected":[{"vendor":"IBM","product":"Concert","versions":[{"version":"1.0.0","status":"affected","lessThanOrEqual":"2.2.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:concert:2.2.0:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7268620","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":6.2,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-340","lang":"en","description":"CWE-340 Generation of Predictable Numbers or Identifiers","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2026-04-07T01:07:38.740Z"},"solutions":[{"lang":"en","value":"IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 2.3.1 Download IBM Concert Software 2.3.1 from Container software library section of IBM Entitled Registry ( ICR ) and follow installation instructions depending on the type of deployment.\n\nIBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 2.3.1\n\nDownload IBM Concert Software 2.3.1 from Container software library section of IBM Entitled Registry ( ICR ) and follow installation instructions depending on the type of deployment.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 2.3.1 Download IBM Concert Software 2.3.1 from Container software library section of IBM Entitled Registry ( ICR ) and follow installation instructions depending on the type of deployment.</p><p>IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 2.3.1</p><p>Download IBM Concert Software 2.3.1 from Container software library section of IBM Entitled Registry ( ICR ) and follow installation instructions depending on the type of deployment.</p>"}]}],"x_generator":{"engine":"ibm-cvegen"},"workarounds":[{"lang":"en","value":"None\n\nNone","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>None</p><p>None</p>"}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-07T16:24:46.603148Z","id":"CVE-2025-13044","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-07T16:24:57.410Z"}}]}}}