CVE-2025-13723
Ibm Sterling Partner Engagement Manager 6.2.3 – 6.2.3.6
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2025-13723 is a medium-severity Use of a Key Past its Expiration Date (CWE-324) vulnerability in Ibm Sterling Partner Engagement Manager. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-13723 affects IBM Sterling Partner Engagement Manager in versions 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2. The vulnerability enables an attacker to obtain sensitive user information by using an expired access token. It is linked to CWE-324 and carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting medium severity with network accessibility, low attack complexity, no privileges or user interaction needed, and low-impact confidentiality exposure.
An unauthenticated remote attacker can exploit this issue over the network with minimal effort. By leveraging an expired access token, the attacker gains read access to sensitive user information, resulting in unauthorized data disclosure without impacting integrity or availability.
IBM's security advisory, available at https://www.ibm.com/support/pages/node/7263391, provides details on the issue and recommended mitigations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208649
Vulnerability Data
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive user information using an expired access token
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-12 requires establishing and managing cryptographic keys including distribution, storage, access and destruction, which directly enforces expiration and rotation policies.
IA-5 requires managing authenticators (including passwords and tokens) with verification, distribution and revocation steps that cover expiration enforcement.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Lifecycle management of cryptographic assets directly includes enforcing key expiration and rotation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Use-of-cryptography control explicitly covers key lifecycle management including expiration and rotation.
Authentication information policy should mandate key rotation and expiry, directly preventing use of expired keys.
Change-management processes can trigger key rotation, but do not inherently enforce cryptographic expiry rules.
Secure authentication requires cryptographic keys to be replaced before expiry, mitigating the weakness.