CVE-2025-36236 - Vulnerability Details - OpenCVE

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to write arbitrary files on the system.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ibm	Aix Vios

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7251173

History

Thu, 13 Nov 2025 22:15:00 +0000

Type	Values Removed	Values Added
Description		IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to write arbitrary files on the system.
Title		AIX Path Traversal
First Time appeared		Ibm Ibm aix Ibm vios
Weaknesses		CWE-22
CPEs		cpe:2.3:a:ibm:vios:3.1:::::::* cpe:2.3:a:ibm:vios:4.1:::::::* cpe:2.3:o:ibm:aix:7.2:::::::* cpe:2.3:o:ibm:aix:7.3:::::::*
Vendors & Products		Ibm Ibm aix Ibm vios
References		https://www.ibm.com/support/pages/node/7251173
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2025-11-13T22:01:31.264Z

Updated: 2025-11-13T22:01:31.264Z

Reserved: 2025-04-15T21:16:42.824Z

Link: CVE-2025-36236

Vulnrichment

No data.

NVD

Status : Received

Published: 2025-11-13T22:15:50.700

Modified: 2025-11-13T22:15:50.700

Link: CVE-2025-36236

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-36236", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:16:42.824Z", "datePublished": "2025-11-13T22:01:31.264Z", "dateUpdated": "2025-11-13T22:01:31.264Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:o:ibm:aix:7.2:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:aix:7.3:*:*:*:*:*:*:*"], "product": "AIX", "vendor": "IBM", "versions": [{"status": "affected", "version": "7.2"}, {"status": "affected", "version": "7.3"}]}, {"cpes": ["cpe:2.3:a:ibm:vios:3.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:vios:4.1:*:*:*:*:*:*:*"], "product": "VIOS", "vendor": "IBM", "versions": [{"status": "affected", "version": "3.1"}, {"status": "affected", "version": "4.1"}]}], "credits": [{"lang": "en", "type": "finder", "value": "These vulnerabilities were reported to IBM by Oneconsult AG (https://oneconsult.com/), Jan Alsenz."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to write arbitrary files on the system.</p>"}], "value": "IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to write arbitrary files on the system."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-11-13T22:01:31.264Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7251173"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">IBM strongly recommends addressing the vulnerability by following the instructions in the fixes and remediation section of the IBM security bulletin: <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7251173\">https://www.ibm.com/support/pages/node/7251173</a></span><br>"}], "value": "IBM strongly recommends addressing the vulnerability by following the instructions in the fixes and remediation section of the IBM security bulletin: https://www.ibm.com/support/pages/node/7251173"}], "title": "AIX Path Traversal", "x_generator": {"engine": "ibm-cvegen"}}}}