Security readout for executives and security teams
Plain-English summary
Affected IBM DOORS web interfaces can let an unauthenticated attacker place JavaScript into the application. A user must interact with the malicious content; the script may then operate within a trusted session, potentially exposing credentials or changing displayed behavior. Availability is not affected according to the supplied CVSS assessment.
Executive priority
Prioritize prompt remediation for internet-facing or broadly accessible deployments because exploitation needs no attacker account and may expose credentials. Internal, tightly restricted deployments remain relevant but can follow risk-based scheduling. The supplied severity is medium, so this warrants tracked action rather than emergency response absent evidence of exploitation.
Technical view
CVE-2025-0152 is a CWE-79 cross-site scripting vulnerability with CVSS 3.1 score 6.1. It is network-accessible, low-complexity, requires no privileges, and requires user interaction. Scope changes, with low confidentiality and integrity impact and no availability impact. The supplied bundle does not identify the specific input, XSS subtype, or fixed versions.
Likely exposure
Exposure applies to IBM Engineering Requirements Management DOORS and DOORS Web Access versions 9.7.2.1 through 9.7.2.11 and 9.6.1.1 through 9.6.1.13. Risk is greater where the Web UI is reachable by untrusted networks or users. The bundle does not establish whether individual deployments expose the vulnerable interface publicly.
Exploitation context
The vulnerability is remotely reachable without authentication but requires a victim to interact with malicious content. Successful exploitation could execute attacker-controlled JavaScript within the trusted Web UI and potentially disclose credentials. The supplied record is not marked KEV and contains no evidence of active exploitation; this does not prove exploitation is absent.
Researcher notes
The source bundle establishes affected ranges, CWE-79, and the CVSS vector, but does not describe the vulnerable parameter, injection persistence, affected endpoints, exploit observations, or fixed releases. Avoid assuming reflected versus stored XSS. Consult IBM advisory 7279145 for remediation specifics and validate exposure without using production credentials or unsafe testing.
Mitigation direction
- Inventory affected DOORS and DOORS Web Access deployments and confirm their exact versions.
- Review IBM advisory 7279145 for supported remediation and fixed-version guidance.
- Apply IBM-provided updates using normal change-control and rollback procedures.
- Restrict Web UI access to trusted networks and authenticated access paths where feasible.
- Warn users against opening untrusted links targeting the affected interface.
Validation and detection
- Confirm deployed versions are outside the affected ranges after remediation.
- Review IBM advisory requirements and verify every applicable component was updated.
- Test the Web UI's critical workflows after updating.
- Review web and security logs for suspicious requests or unexpected script-related activity.
- Verify external and untrusted network paths cannot unnecessarily reach the Web UI.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-0152 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N2.82.7ibmVulnerability scoring details
Base CVSS 3.1 score
6.1MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ibm.com/support/pages/node/7279145CVE reference, ibm · vendor-advisory, patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.