CVE-2025-27909 MEDIUM

CVE-2025-27909: IBM Concert Software cross-origin resource sharing

Vendor Ibm
Product Concert Software
Weakness CWE-942
Published August 18, 2025
Last update August 18, 2025
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.

Key dates

02Disclosure timeline

August 18, 2025 CVE published
August 18, 2025 Record updated