← Back

CVE-2025-3356

nvd nist
Published: Oct 30, 2025Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view, overwrite, or append to arbitrary files on the system.

Affected (22)

Ibm
1 product
Tivoli Monitoring
Configuration A
22 vulnerable
Vulnerable SoftwareAffected Versions
Ibm
Tivoli Monitoring
Version 6.3.0.7
Tivoli Monitoring
Version 6.3.0.7 sp10
Tivoli Monitoring
Version 6.3.0.7 sp11
Tivoli Monitoring
Version 6.3.0.7 sp12
Tivoli Monitoring
Version 6.3.0.7 sp13
Tivoli Monitoring
Version 6.3.0.7 sp14
Tivoli Monitoring
Version 6.3.0.7 sp15
Tivoli Monitoring
Version 6.3.0.7 sp16
Tivoli Monitoring
Version 6.3.0.7 sp17
Tivoli Monitoring
Version 6.3.0.7 sp18
Tivoli Monitoring
Version 6.3.0.7 sp19
Tivoli Monitoring
Version 6.3.0.7 sp1
Tivoli Monitoring
Version 6.3.0.7 sp20
Tivoli Monitoring
Version 6.3.0.7 sp21
Tivoli Monitoring
Version 6.3.0.7 sp2
Tivoli Monitoring
Version 6.3.0.7 sp3
Tivoli Monitoring
Version 6.3.0.7 sp4
Tivoli Monitoring
Version 6.3.0.7 sp5
Tivoli Monitoring
Version 6.3.0.7 sp6
Tivoli Monitoring
Version 6.3.0.7 sp7
Tivoli Monitoring
Version 6.3.0.7 sp8
Tivoli Monitoring
Version 6.3.0.7 sp9

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (1)

Source: psirt@us.ibm.com
Vendor Advisory

Timeline

No history available yet.