CVE-2025-27907: IBM WebSphere Application Server server-side request forgery
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Other sources
IBM WebSphere Application Server is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27907?
The severity of CVE-2025-27907 is considered high due to its potential for exploiting server-side request forgery.
How do I fix CVE-2025-27907?
To fix CVE-2025-27907, apply the latest patches provided by IBM for WebSphere Application Server 8.5 and 9.0.
Who is affected by CVE-2025-27907?
CVE-2025-27907 affects users of IBM WebSphere Application Server versions 8.5 and 9.0, particularly those using the Feature Pack for Web Services.
What kind of attacks can CVE-2025-27907 facilitate?
CVE-2025-27907 can facilitate unauthorized network enumeration and may lead to further attacks by allowing attackers to send requests from the vulnerable system.
Is CVE-2025-27907 exploitable remotely?
Yes, CVE-2025-27907 is exploitable remotely by authenticated attackers on the affected IBM WebSphere Application Server.