CVE-2025-2824

IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7241286	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:::::::*
	cpe:2.3:a:ibm:operational_decision_manager:8.11.1.0:::::::*
	cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:::::::*
	cpe:2.3:a:ibm:operational_decision_manager:9.0.0.1:::::::*
	cpe:2.3:a:ibm:operational_decision_manager:9.5.0:::::::*

History

No history.

Information

Published : 2025-08-01 18:15

Updated : 2025-08-14 18:49

NVD link : CVE-2025-2824

Mitre link : CVE-2025-2824

CVE.ORG link : CVE-2025-2824

JSON object : View

Products Affected

ibm

operational_decision_manager

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2025-2824", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.8}]}, "published": "2025-08-01T18:15:51.587", "references": [{"url": "https://www.ibm.com/support/pages/node/7241286", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim."}, {"lang": "es", "value": "IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1 y 9.5.0 podr\u00eda permitir que un atacante remoto realice ataques de phishing mediante un ataque de redirecci\u00f3n abierta. Al persuadir a la v\u00edctima para que visite un sitio web especialmente manipulado, un atacante remoto podr\u00eda explotar esta vulnerabilidad para falsificar la URL mostrada y redirigir al usuario a un sitio web malicioso aparentemente confiable. Esto podr\u00eda permitir al atacante obtener informaci\u00f3n altamente sensible o realizar nuevos ataques contra la v\u00edctima."}], "lastModified": "2025-08-14T18:49:21.380", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "354E0F39-CA38-4A27-973B-7415C7A40FC2"}, {"criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.11.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4E8894F-E7F5-4514-873A-C63CB8DFCC6C"}, {"criteria": "cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60B60CD2-D71D-43FE-B9AD-A11FE5FC132E"}, {"criteria": "cpe:2.3:a:ibm:operational_decision_manager:9.0.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DCB5F24-4C9B-4D1F-85BE-08708EFB777A"}, {"criteria": "cpe:2.3:a:ibm:operational_decision_manager:9.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2CD731C1-390A-401C-A2BC-931445381424"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}