CVE-2025-27907

🗓️ 22 Apr 2025 16:20:21Reported by ibmType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 93 Views

IBM WebSphere Application Server is vulnerable to server-side request forgery allowing unauthorized requests.

Reporter	Title	Published	Views	Family All 29
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by a server-side request forgery vulnerability (CVE-2025-27907)	2 May 202515:59	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server, which is a required product for IBM Tivoli Network Manager IP Edition (CVE-2025-27907)	2 Jun 202513:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server is vulnerable to server-side request forgery (CVE-2025-27907)	30 Apr 202512:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities within WebSphere Application and IBM HTTP Server, affect IBM Tivoli Monitoring.	9 Jul 202516:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by a server-side request forgery vulnerability (CVE-2025-27907)	2 May 202516:19	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Security Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2025-27907)	28 Apr 202509:20	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Buinses Automation Workflow (CVE-2025-27907)	2 May 202508:11	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2025-27907)	6 Aug 202511:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a server-side request forgery vulnerability (CVE-2025-27907)	2 May 202516:10	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability has been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2025-27907)	23 Apr 202512:40	–	ibm

NVD

Vulners

Node

ibm websphere_application_serverRange8.5–8.5.5.28

ibm websphere_application_serverRange9.0–9.0.5.24

AND

hp hp-uxMatch-

ibm aixMatch-

ibm iMatch-

ibm z/osMatch-

linux linux_kernelMatch-

microsoft windowsMatch-

oracle solarisMatch-

[
  {
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "WebSphere Application Server",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "8.5"
      },
      {
        "status": "affected",
        "version": "9.0"
      }
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7231514

01 Sep 2025 00:38Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.12.7 - 4.1

EPSS0.00123

SSVC

CWE-918