IBM Safer Payments could allow an authenticated user to obtain sensitive information
Summary
| CVE | CVE-2025-36075 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-08 16:16:35 UTC |
| Updated | 2026-11-08 16:16:36 UTC |
| Description | IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information. |
Risk And Classification
Primary CVSS: v3.1 5.3 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-1287 | CWE-1287 CWE-1287 Improper Validation of Specified Type of Input
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | CNA | CVSS | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | IBM | Safer Payments | affected 6.4.0.00 6.4.2.11 semver | Not specified |
| CNA | IBM | Safer Payments | affected 6.5.0.00 6.5.0.09 semver | Not specified |
| CNA | IBM | Safer Payments | affected 6.6.0.00 6.6.0.07 semver | Not specified |
| CNA | IBM | Safer Payments | affected 6.7.0.00 6.7.0.03 semver | Not specified |
| CNA | IBM | Safer Payments | affected 6.8.0.00 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.ibm.com/support/pages/node/7293213 | [email protected] | www.ibm.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Update IBM Safer Payments to version 6.4.2.12, 6.5.0.10, 6.6.0.08, 6.7.0.04, 6.8.0.01 or higher. Refer to the IBM Safer Payments documentation https://www.ibm.com/docs/en/safer-payments to download the updates.
There are currently no legacy QID mappings associated with this CVE.