CVE-2025-36090 IBM Analytics Content Hub information disclosure
Remote attackers can obtain application framework details via error messages, aiding reconnaissance for future attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-36090?
CVE-2025-36090 is a medium-severity vulnerability in IBM Analytics Content Hub, published on 10 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain information about the application framework which could be used in reconnaissance to gather information for future attacks from a detailed technical error message.
Weakness: CWE-209
Which versions are affected by CVE-2025-36090?
It affects 1 product.
Products include Ibm Analytics Content Hub.
How do I fix CVE-2025-36090?
No fix has been published for CVE-2025-36090 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-36090 being exploited?
There is no known exploitation of CVE-2025-36090 in the wild and no public exploit code.
Other vulnerabilities in IBM Analytics Content Hub
- CVE-2024-39750 IBM Analytics Content Hub buffer overflow
- CVE-2024-38327 IBM Analytics Content Hub information disclosure
- CVE-2024-39752 IBM Analytics Content Hub file upload
- CVE-2024-37524 IBM Analytics Content Hub information disclosure
- CVE-2024-35134 IBM Analytics Content Hub information disclosure
Sources
Also known as GHSA-8pv2-w89q-5fxp.