CVE-2025-36082 (GCVE-0-2025-36082)

Vulnerability from cvelistv5 – Published: 2025-09-15 15:31 – Updated: 2025-09-15 15:52
VLAI?
Summary
IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system.
Severity ?
4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-525 - Information Exposure Through Browser Caching
Assigner
ibm
References
Impacted products
Vendor Product Version
IBM OpenPages Affected: 9.0
Affected: 9.1
    cpe:2.3:a:ibm:openpages_with_watson:9.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:openpages_with_watson:9.1:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-36082",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-15T15:52:43.589158Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-15T15:52:49.614Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:openpages_with_watson:9.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:openpages_with_watson:9.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "OpenPages",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "9.0"
            },
            {
              "status": "affected",
              "version": "9.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system."
            }
          ],
          "value": "IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-525",
              "description": "CWE-525 Information Exposure Through Browser Caching",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T15:31:45.446Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7244777"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAffected endpoints have been updated to use Cache-Control : no-store header to align with security best practices. A fix has been created for each affected version of the named product. Download and install the fix as soon as possible. Fixes and installation instructions are provided at the URLs listed below:\u003c/p\u003e\u003cp\u003e\u0026nbsp;\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003e\u003cstrong\u003eProduct\u003c/strong\u003e\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u003cstrong\u003eRemediation\u003c/strong\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eFor IBM OpenPages \u003cstrong\u003e9.1.1\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u0026nbsp;\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u003cstrong\u003eDownload URL for 9.1.1\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://ibm.com/support/pages/downloading-ibm-openpages-version-911-passport-advantage\"\u003ehttp://ibm.com/support/pages/downloading-ibm-openpages-version-911-passport-advantage\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eFor IBM OpenPages \u003cstrong\u003e9.0\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u0026nbsp;\u003c/p\u003e\u003cp\u003e- Apply 9.0 FixPack 5 \u003cstrong\u003e(9.0.0.5)\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e- Then Apply 9.0.05 Interim Fix 5 (\u003cstrong\u003e9.0.0.5.5\u003c/strong\u003e)\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u003cstrong\u003eDownload URL for 9.0.0.5\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-5\"\u003ehttps://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-5\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eDownload URL for 9.0.0.5.5\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/ibm-openpages-9005-interim-fix-5\"\u003ehttps://www.ibm.com/support/pages/ibm-openpages-9005-interim-fix-5\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u0026nbsp;\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003cbr\u003eFor IBM OpenPages v8.0/8.1/8.2/8.3 customers, IBM recommends to upgrade to a fixed and supported version\u003cstrong\u003e\u0026nbsp;9.0 or \u003c/strong\u003e\u003cstrong\u003e9.1.1\u003c/strong\u003e\u0026nbsp;of the product.\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Affected endpoints have been updated to use Cache-Control : no-store header to align with security best practices. A fix has been created for each affected version of the named product. Download and install the fix as soon as possible. Fixes and installation instructions are provided at the URLs listed below:\n\n\u00a0\n\nProduct\n\nRemediation\n\nFor IBM OpenPages 9.1.1\n\n\u00a0\n\nDownload URL for 9.1.1\n\n http://ibm.com/support/pages/downloading-ibm-openpages-version-911-passport-advantage \n\nFor IBM OpenPages 9.0\n\n\u00a0\n\n- Apply 9.0 FixPack 5 (9.0.0.5)\n\n- Then Apply 9.0.05 Interim Fix 5 (9.0.0.5.5)\n\nDownload URL for 9.0.0.5\n\n https://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-5 \n\n\u00a0\n\nDownload URL for 9.0.0.5.5\n\n https://www.ibm.com/support/pages/ibm-openpages-9005-interim-fix-5 \n\n\u00a0\n\n\n\n\u00a0\n\n\nFor IBM OpenPages v8.0/8.1/8.2/8.3 customers, IBM recommends to upgrade to a fixed and supported version\u00a09.0 or 9.1.1\u00a0of the product."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM OpenPages information disclosure",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2025-36082",
    "datePublished": "2025-09-15T15:31:45.446Z",
    "dateReserved": "2025-04-15T21:16:13.890Z",
    "dateUpdated": "2025-09-15T15:52:49.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-36082\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2025-09-15T16:15:37.267\",\"lastModified\":\"2025-09-24T13:17:27.520\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":4.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.5,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":3.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-525\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:openpages:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0.0\",\"versionEndExcluding\":\"9.0.0.5\",\"matchCriteriaId\":\"A4D7EA3D-F8C3-48AB-942A-11919C0B7687\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:openpages:9.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F78E4CFE-31E7-4FFF-8DB4-6D7AC69A2248\"}]}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7244777\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-36082\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-09-15T15:52:43.589158Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-09-15T15:52:46.041Z\"}}], \"cna\": {\"title\": \"IBM OpenPages information disclosure\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:openpages_with_watson:9.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:openpages_with_watson:9.1:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"OpenPages\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.0\"}, {\"status\": \"affected\", \"version\": \"9.1\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Affected endpoints have been updated to use Cache-Control : no-store header to align with security best practices. A fix has been created for each affected version of the named product. Download and install the fix as soon as possible. Fixes and installation instructions are provided at the URLs listed below:\\n\\n\\u00a0\\n\\nProduct\\n\\nRemediation\\n\\nFor IBM OpenPages 9.1.1\\n\\n\\u00a0\\n\\nDownload URL for 9.1.1\\n\\n http://ibm.com/support/pages/downloading-ibm-openpages-version-911-passport-advantage \\n\\nFor IBM OpenPages 9.0\\n\\n\\u00a0\\n\\n- Apply 9.0 FixPack 5 (9.0.0.5)\\n\\n- Then Apply 9.0.05 Interim Fix 5 (9.0.0.5.5)\\n\\nDownload URL for 9.0.0.5\\n\\n https://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-5 \\n\\n\\u00a0\\n\\nDownload URL for 9.0.0.5.5\\n\\n https://www.ibm.com/support/pages/ibm-openpages-9005-interim-fix-5 \\n\\n\\u00a0\\n\\n\\n\\n\\u00a0\\n\\n\\nFor IBM OpenPages v8.0/8.1/8.2/8.3 customers, IBM recommends to upgrade to a fixed and supported version\\u00a09.0 or 9.1.1\\u00a0of the product.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAffected endpoints have been updated to use Cache-Control : no-store header to align with security best practices. A fix has been created for each affected version of the named product. Download and install the fix as soon as possible. Fixes and installation instructions are provided at the URLs listed below:\u003c/p\u003e\u003cp\u003e\u0026nbsp;\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003e\u003cstrong\u003eProduct\u003c/strong\u003e\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u003cstrong\u003eRemediation\u003c/strong\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eFor IBM OpenPages \u003cstrong\u003e9.1.1\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u0026nbsp;\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u003cstrong\u003eDownload URL for 9.1.1\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"http://ibm.com/support/pages/downloading-ibm-openpages-version-911-passport-advantage\\\"\u003ehttp://ibm.com/support/pages/downloading-ibm-openpages-version-911-passport-advantage\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eFor IBM OpenPages \u003cstrong\u003e9.0\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u0026nbsp;\u003c/p\u003e\u003cp\u003e- Apply 9.0 FixPack 5 \u003cstrong\u003e(9.0.0.5)\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e- Then Apply 9.0.05 Interim Fix 5 (\u003cstrong\u003e9.0.0.5.5\u003c/strong\u003e)\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u003cstrong\u003eDownload URL for 9.0.0.5\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-5\\\"\u003ehttps://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-5\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eDownload URL for 9.0.0.5.5\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.ibm.com/support/pages/ibm-openpages-9005-interim-fix-5\\\"\u003ehttps://www.ibm.com/support/pages/ibm-openpages-9005-interim-fix-5\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u0026nbsp;\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003cbr\u003eFor IBM OpenPages v8.0/8.1/8.2/8.3 customers, IBM recommends to upgrade to a fixed and supported version\u003cstrong\u003e\u0026nbsp;9.0 or \u003c/strong\u003e\u003cstrong\u003e9.1.1\u003c/strong\u003e\u0026nbsp;of the product.\u003c/p\u003e\\n\\n\u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7244777\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-525\", \"description\": \"CWE-525 Information Exposure Through Browser Caching\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2025-09-15T15:31:45.446Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-36082\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-09-15T15:52:49.614Z\", \"dateReserved\": \"2025-04-15T21:16:13.890Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2025-09-15T15:31:45.446Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.