CVE-2025-36075 PUBLISHED

IBM Safer Payments could allow an authenticated user to obtain sensitive information

Assigner: ibm
Reserved: 15.04.2025 Published: 08.11.2026 Updated: 08.11.2026

IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 5.3

Product Status

Vendor IBM
Product Safer Payments
Versions
  • affected from 6.4.0.00 to 6.4.2.11 (incl.)
  • affected from 6.5.0.00 to 6.5.0.09 (incl.)
  • affected from 6.6.0.00 to 6.6.0.07 (incl.)
  • affected from 6.7.0.00 to 6.7.0.03 (incl.)
  • Version 6.8.0.00 is affected

Solutions

Update IBM Safer Payments to version 6.4.2.12, 6.5.0.10, 6.6.0.08, 6.7.0.04, 6.8.0.01 or higher.

Refer to the IBM Safer Payments documentation https://www.ibm.com/docs/en/safer-payments  to download the updates.

References

Problem Types

  • CWE-1287 Improper Validation of Specified Type of Input CWE