Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2025-13491
PUBLISHED
More InfoOfficial Page
Assigner-ibm
Assigner Org ID-9a959283-ebb5-44b6-b705-dcc2bbced522
View Known Exploited Vulnerability (KEV) details
Published At-05 Feb, 2026 | 13:55
Updated At-05 Feb, 2026 | 14:46
Rejected At-
▼CVE Numbering Authority (CNA)
IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to loss of confidentiality []

IBM App Connect Enterprise Certified Container up to 12.19.0 (Continuous Delivery) and 12.0 LTS (Long Term Support) could allow an attacker to access sensitive files or modify configurations due to an untrusted search path.

Affected Products
Vendor
IBM CorporationIBM
Product
App Connect Operator
CPEs
  • cpe:2.3:a:ibm:app_connect_operator:cd:11.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:app_connect_operator:11.6.0:*:*:*:*:*:*:*
Versions
Affected
  • From CD:11.2.0 through 11.6.0, 12.1.0 - 12.19.012.0 (semver)
  • LTS:12.0.0 - 12.0.19
Vendor
IBM CorporationIBM
Product
App Connect EnterpriseCertified Containers Operands
CPEs
  • cpe:2.3:a:ibm:app_connect_enterprisecertified_containers_operands:cd:12.0.11.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:app_connect_enterprisecertified_containers_operands:r1:*:*:*:*:*:*:*
Versions
Affected
  • From CD:12.0.11.1 through r1 - 12.0.12.5-r1, 13.0.1.0-r1 - 13.0.6.0-r112.0 (semver)
  • LTS:12.0.12-r1 - 12.0.12-r19
Problem Types
TypeCWE IDDescription
CWECWE-426CWE-426 Untrusted Search Path
Type: CWE
CWE ID: CWE-426
Description: CWE-426 Untrusted Search Path
Metrics
VersionBase scoreBase severityVector
3.15.1MEDIUM
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Version: 3.1
Base score: 5.1
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

IBM strongly suggests the following: App Connect Enterprise Certified Container up to 12.19.0 (Continuous Delivery) Upgrade to App Connect Enterprise Certified Container Operator version 12.20.0 or higher, and ensure that all DesignerAuthoring components are at 13.0.6.1-r1 or higher.  Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator App Connect Enterprise Certified Container 12.0 LTS (Long Term Support) Upgrade to App Connect Enterprise Certified Container Operator version 12.0.20 or higher, and ensure that all DesignerAuthoring components are at 12.0.12-r20 or higher.  Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases

Configurations
Workarounds

Disable mapping assistance in the DesignerAuthoring component

Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.ibm.com/support/pages/node/7259746
vendor-advisory
patch
Hyperlink: https://www.ibm.com/support/pages/node/7259746
Resource:
vendor-advisory
patch
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found