CVE-2025-36085 - Multiple Vulnerabilities in IBM Concert Software.

Back Back to CVE browser

MEDIUM

Multiple Vulnerabilities in IBM Concert Software.

Published Oct 28, 2025

5.4

MEDIUM

CVSS 3.1

EPSS 0.18%

Description

IBM Concert 1.0.0 through 2.0.0 Software is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Affected products

Vendor IBM Product Concert Default
unaffected
Affected
- ≥ 1.0.0, ≤ 2.0.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
IBM	Concert	unaffected	Affected ≥ 1.0.0, ≤ 2.0.0

Remediation

Vendor solution

Remediation/Fixes IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 2.1.0 Download IBM Concert Software 2.1.0 from Container software library section of IBM Entitled Registry ( ICR ) and follow installation instructions depending on the type of deployment.

Weaknesses (1)

CWE-918

SSRF