IBM DOORS Next Generation multiple vulnerabilities
view advisory published 2025-10-22
IBM Engineering Requirements Management DOORS contains multiple vulnerabilities that require authentication. These vulnerabilities include the ability to cause an application denial of service and JavaScript execution in the victim's browser through stored cross site scripting.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-13734US | —OT elevated | — | ||
IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow an authenticated user to view and edit data beyond their authorized access permissions. | ||||
| CVE-2025-2134US | — | — | ||
IBM Jazz Reporting Service could allow an authenticated user on the network to affect the system's performance using complicated queries due to insufficient resource pooling. | ||||
| CVE-2025-27550US | — | — | ||
IBM Jazz Reporting Service could allow an authenticated user on the host network to obtain sensitive information about other projects that reside on the server. | ||||
| CVE-2025-1823US | low3.5 | — | ||
IBM Jazz Reporting Service could allow an authenticated user on the host network to cause a denial of service using specially crafted SQL query that consumes excess memory resource… | ||||
| CVE-2025-33096US | — | — | ||
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user to cause a denial of service by uploading specially crafted files using u… | ||||
| CVE-2025-2140US | — | — | ||
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper veri… | ||||
| CVE-2025-2139US | — | — | ||
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users due to client-side enfo… | ||||
| CVE-2025-2138US | low3.5 | — | ||
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1
could allow an authenticated user on the network to delete comments from other users due to client-side e… | ||||
| CVE-2025-1826US | — | — | ||
IBM Engineering Requirements Management DOORS Next (IBM Jazz Foundation 7.0.2 to 7.0.2 iFix034, 7.0.3 to 7.0.3 iFix016, and 7.1.0 to 7.1.0 iFix004) is vulnerable to stored cross-si… | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (9)
- FixedEngineering Requirements Management DOORS Next
Fixed in 7.0.2 iFix036.
https://www.ibm.com/support/pages/node/7247716 - FixedEngineering Requirements Management DOORS Next
Fixed in 7.0.2 iFix036.
https://www.ibm.com/support/pages/node/7247716 - FixedEngineering Requirements Management DOORS Next
Fixed in 7.0.2 iFix036.
https://www.ibm.com/support/pages/node/7247716 - FixedEngineering Requirements Management DOORS Next
Fixed in 7.0.2 iFix036.
https://www.ibm.com/support/pages/node/7247716 - FixedEngineering Requirements Management DOORS Next
Fixed in 7.1 iFix008.
https://www.ibm.com/support/pages/node/7261900 - FixedJazz Foundation
Fixed in 7.0.2 iFix035.
https://www.ibm.com/support/pages/node/7247292 - FixedJazz Reporting Service
Fixed in 7.0.3 iFix021.
https://www.ibm.com/support/pages/node/7258083 - FixedJazz Reporting Service
Fixed in 7.0.3 iFix021.
https://www.ibm.com/support/pages/node/7258083 - FixedJazz Reporting Service
Fixed in 7.0.3 iFix021.
https://www.ibm.com/support/pages/node/7258083
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan