CVE-2025-36149
Ibm Concert 1.0.0 – 2.1.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LSummary
CVE-2025-36149 is a medium-severity Improper Restriction of Rendered UI Layers or Frames (CWE-1021) vulnerability in Ibm Concert. Its CVSS base score is 6.3 (Medium).
Operationally, ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-15 (Information Output Filtering) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-198503
Vulnerability Data
IBM Concert Software 1.0.0 through 2.0.0 could allow a remote attacker to hijack the clicking action of the victim.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CWE-1021 by requiring the system to filter rendered output (e.g., emit X-Frame-Options or CSP frame-ancestors directives) so that attacker-controlled pages cannot overlay and hijack clicks.
Enforces information-flow rules on UI content so that pages from untrusted origins cannot be framed inside the Concert application, limiting clickjacking vectors.
Strengthens session authenticity tokens presented in the UI, reducing the impact if a clickjacking overlay succeeds in triggering unintended authenticated actions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require implementing frame-ancestors / X-Frame-Options controls that prevent this weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing frame protections, but does not itself implement the control.
Web filtering can block or sandbox untrusted frames, but does not enforce application-level frame-busting or CSP.
Application security requirements can mandate frame-ancestors / X-Frame-Options, directly addressing UI redressing risks.
Secure architecture principles include isolation of UI layers and proper use of browser security controls.
Secure coding practices directly require implementation of frame-busting headers or CSP frame-ancestors directives.