CVE-2025-15399: Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Other sources
IBM Common Licensing is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Common Licensingto a version that resolves this vulnerability.Fixed in 9.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker would need to cause a user trusted by the IBM Common Licensing website to submit a malicious request. The vulnerability involves cross-site request forgery, so exploitation relies on actions being transmitted in the context of that trusted user.
What could exploitation allow?
Successful exploitation could allow malicious and unauthorized actions to be executed through requests transmitted from a user the website trusts.