CVE-2025-27909
18.08.2025, 14:15
IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.Enginsight
| Vendor | Product | Version |
|---|---|---|
| ibm | concert | 1.0.0 ≤ 𝑥 < 2.0.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-942 - Permissive Cross-domain Policy with Untrusted DomainsThe software uses a cross-domain policy file that includes domains that should not be trusted.
- CWE-697 - Incorrect ComparisonThe software compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.