Improper Check for Unusual or Exceptional Conditions in http-proxy-middleware - CVE-2025-32997

Vulnerability identifier: #VU108924

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-32997

CWE-ID: CWE-754

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to modify data on the system.

The vulnerability exists due to improper error handling. A remote attacker can send specially crafted data to the application and modify data on the system.

http-proxy-middleware
Netcool Operations Insight
IBM Cloud Pak for Security
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Security Verify Governance
App Connect Enterprise Certified Container
IBM Cloud Pak for Business Automation
QRadar Suite
IBM Cloud Pak System
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Maximo Application Suite - Monitor Component
Maximo Application Suite - Edge Data Collector
Business Automation Insights
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
Maximo Application Suite - IoT Component

Install updates from vendor's website.

http-proxy-middleware - addressed in versions 2.0.9, 3.0.5
Netcool Operations Insight - update to 1.6.15
IBM Cloud Pak for Security - update to 1.11.3.0
QRadar Suite - update to 1.11.3.0
IBM Cloud Pak System - update to 2.3.6.0
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2.0.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.2.1
Maximo Application Suite - Monitor Component - addressed in versions 8.10.20, 8.11.18, 9.0.10
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.23, 9.0.15, 9.1.5
IBM Security Verify Governance - update to 10.0.2.0.7
Business Automation Insights - addressed in versions 24.0.0.0.4, 24.0.1.0.4
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.2.1
Maximo Application Suite - IoT Component - addressed in versions 8.7.24, 8.8.20, 9.0.10, 9.1.1
App Connect Enterprise Certified Container - addressed in versions 12.0.11, 12.11.0
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF006, 24.0.1-IF004, 25.0.0-IF001

• https://github.com/chimurai/http-proxy-middleware/commit/1bdccbeec243850f1d2bb50ea0ff2151e725d67e
• https://github.com/chimurai/http-proxy-middleware/pull/1096
• https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.9
• https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.5

• Improper check for unusual or exceptional conditions in http-proxy-middleware
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in IBM Cloud Pak for Security and IBM QRadar Suite Software
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Edge Data Collector
• Multiple vulnerabilities in IBM Security Verify Governance