CVE-2025-3356
Published: 30 October 2025
Summary
CVE-2025-3356 is a high-severity Path Traversal (CWE-22) vulnerability in Ibm Tivoli Monitoring. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Information input validation directly prevents directory traversal attacks by checking and rejecting specially crafted URL requests containing '../' sequences.
Flaw remediation ensures the specific directory traversal vulnerability in IBM Tivoli Monitoring is identified and patched per the IBM advisory.
Boundary protection at external interfaces monitors and controls network traffic to block or detect malicious directory traversal requests.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directory traversal in public-facing IBM Tivoli Monitoring enables remote unauthenticated exploitation (T1190) for arbitrary file read/write (confidentiality/integrity impacts) and high availability disruption via file manipulation (T1499.004).
NVD Description
IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view, overwrite, or append to…
more
arbitrary files on the system.
Deeper analysisAI
CVE-2025-3356 is a directory traversal vulnerability (CWE-22) affecting IBM Tivoli Monitoring versions 6.3.0.7 through 6.3.0.7 Service Pack 21. It enables a remote attacker to access files outside the intended directory by sending a specially crafted URL request containing "dot dot" sequences (/../). The vulnerability has a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), rated as High severity due to its potential for significant impact.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows the attacker to view arbitrary files for limited confidentiality loss, overwrite or append to arbitrary files for limited integrity impact, and potentially cause high availability disruption, such as denial of service through file manipulation.
IBM has published an advisory at https://www.ibm.com/support/pages/node/7249694 providing details on the vulnerability, affected versions, and recommended mitigations or patches. Security practitioners should consult this resource for specific remediation steps.
Details
- CWE(s)