CVE-2025-2697

IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7242159	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:cognos_command_center:10.2.4.1:::::::*
	cpe:2.3:a:ibm:cognos_command_center:10.2.5:::::::*

History

02 Sep 2025, 18:06

Type	Values Removed	Values Added
CPE		cpe:2.3:a:ibm:cognos_command_center:10.2.4.1:::::::* cpe:2.3:a:ibm:cognos_command_center:10.2.5:::::::*
First Time		Ibm Ibm cognos Command Center
References	~~() https://www.ibm.com/support/pages/node/7242159 -~~	() https://www.ibm.com/support/pages/node/7242159 - Vendor Advisory

29 Aug 2025, 16:22

Type	Values Removed	Values Added
Summary		(es) IBM Cognos Command Center 10.2.4.1 y 10.2.5 podría permitir que un atacante remoto realice ataques de phishing mediante un ataque de redirección abierta. Al persuadir a la víctima para que visite un sitio web especialmente manipulado, un atacante remoto podría explotar esta vulnerabilidad para falsificar la URL mostrada y redirigir al usuario a un sitio web malicioso aparentemente confiable. Esto podría permitir al atacante obtener información altamente sensible o realizar nuevos ataques contra la víctima.

26 Aug 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-26 17:15

Updated : 2025-09-02 18:06

NVD link : CVE-2025-2697

Mitre link : CVE-2025-2697

CVE.ORG link : CVE-2025-2697

JSON object : View

Products Affected

ibm

cognos_command_center

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2025-2697", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.8}]}, "published": "2025-08-26T17:15:37.320", "references": [{"url": "https://www.ibm.com/support/pages/node/7242159", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "IBM Cognos Command Center 10.2.4.1 and 10.2.5 \n\ncould allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim."}, {"lang": "es", "value": "IBM Cognos Command Center 10.2.4.1 y 10.2.5 podr\u00eda permitir que un atacante remoto realice ataques de phishing mediante un ataque de redirecci\u00f3n abierta. Al persuadir a la v\u00edctima para que visite un sitio web especialmente manipulado, un atacante remoto podr\u00eda explotar esta vulnerabilidad para falsificar la URL mostrada y redirigir al usuario a un sitio web malicioso aparentemente confiable. Esto podr\u00eda permitir al atacante obtener informaci\u00f3n altamente sensible o realizar nuevos ataques contra la v\u00edctima."}], "lastModified": "2025-09-02T18:06:52.323", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:cognos_command_center:10.2.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BA2D482-F396-4704-ACBA-E81720686DDB"}, {"criteria": "cpe:2.3:a:ibm:cognos_command_center:10.2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1F58E67-8E8F-4DA0-B9C0-68683BDAB5A8"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}