{"id":"CVE-2025-25022","state":"PUBLISHED","title":"IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosure","description":"IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an unauthenticated user in the environment to obtain highly sensitive information in configuration files.","publishedAt":"2025-06-03T15:16:19.691Z","updatedAt":"2026-02-26T18:27:38.077Z","severity":{"score":9.6,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"ibm"},"assigner":"ibm","products":["IBM QRadar Suite Software","IBM Cloud Pak for Security"],"affected":[{"vendor":"IBM","product":"QRadar Suite Software","defaultStatus":"unaffected","versions":[{"version":"1.10.12.0","status":"affected","lessThanOrEqual":"1.11.2.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:qradar_suite:1.10.12.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:qradar_suite:1.11.2.0:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"Cloud Pak for Security","defaultStatus":"unaffected","versions":[{"version":"1.10.0.0","status":"affected","lessThanOrEqual":"1.10.11.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:cloud_pak_for_security:1.10.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:cloud_pak_for_security:1.10.11.0:*:*:*:*:*:*:*"]}],"references":["https://www.ibm.com/support/pages/node/7235432"],"weaknesses":["CWE-260"],"ingestedAt":"2026-10-29T20:08:47.682Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/25xxx/CVE-2025-25022.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-25022","state":"PUBLISHED","datePublished":"2025-06-03T15:16:19.691Z","dateUpdated":"2026-02-26T18:27:38.077Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2025-01-31T16:26:45.223Z"},"containers":{"cna":{"title":"IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosure","descriptions":[{"lang":"en","value":"IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an unauthenticated user in the environment to obtain highly sensitive information in configuration files."}],"affected":[{"vendor":"IBM","product":"QRadar Suite Software","defaultStatus":"unaffected","versions":[{"version":"1.10.12.0","status":"affected","lessThanOrEqual":"1.11.2.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:qradar_suite:1.10.12.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:qradar_suite:1.11.2.0:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"Cloud Pak for Security","defaultStatus":"unaffected","versions":[{"version":"1.10.0.0","status":"affected","lessThanOrEqual":"1.10.11.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:cloud_pak_for_security:1.10.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:cloud_pak_for_security:1.10.11.0:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7235432","tags":["vendor-advisory","patch"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-260","description":"CWE-260 Password in Configuration File","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2025-08-26T14:53:06.088Z"},"credits":[{"lang":"en","type":"finder","value":"John Zuccato, Rodney Ryan, Chris Shepherd, Vince Dragnea, Ben Goodspeed, Dawid Bak"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"IBM strongly encourages customers to update their systems promptly.<br><br>Please upgrade to at least version 1.11.3.0 according to the following instructions:<br><br><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/docs/en/cloud-paks/cp-security/1.11?topic=installing\">https://www.ibm.com/docs/en/cloud-paks/cp-security/1.11?topic=installing</a><br><br><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/docs/en/cloud-paks/cp-security/1.11?topic=upgrading\">https://www.ibm.com/docs/en/cloud-paks/cp-security/1.11?topic=upgrading</a><br>"}],"value":"IBM strongly encourages customers to update their systems promptly.\n\nPlease upgrade to at least version 1.11.3.0 according to the following instructions:\n\n https://www.ibm.com/docs/en/cloud-paks/cp-security/1.11?topic=installing \n\n https://www.ibm.com/docs/en/cloud-paks/cp-security/1.11?topic=upgrading"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-25022","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-06-04T03:56:06.436182Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T18:27:38.077Z"}}]}}}