Improper Certificate Validation in IBM WebSphere Application Server - CVE-2025-33142

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU114097

Improper Certificate Validation in IBM WebSphere Application Server - CVE-2025-33142

Published: August 15, 2025


Vulnerability identifier: #VU114097
CSH Severity: Medium
CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-33142
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can gain unauthorized access to sensitive information on the system.


Affected software

IBM WebSphere Application Server
Enterprise Application Runtimes
Tivoli Network Manager IP Edition
Cloud Pak for Applications
WebSphere Hybrid Edition
Engineering Test Management
Tivoli Composite Application Manager for Application Diagnostics
DevOps Code ClearCase
Jazz for Service Management
IBM Tivoli System Automation Application Manager
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Maximo Asset Management
WebSphere Remote Server
WebSphere Service Registry and Repository
IBM Rational ClearCase
IBM Rational ClearQuest
IBM Business Automation Workflow
IBM Tivoli Monitoring

How to mitigate CVE-2025-33142

Install updates from vendor's website.

IBM WebSphere Application Server - addressed in versions 8.5.5.29, 9.0.5.25
Tivoli Network Manager IP Edition - update to 4.2.0.23
IBM Tivoli Monitoring - update to 6.3.0.7 Plus Service Pack 5

External References

Related Security Bulletins