Read the docs
TI-2025-02944 Aliases CVE-2025-3356GHSA-fw76-qjj6-w857

IBM Tivoli Monitoring is vulnerable to unauthenticated file read and write operations

Priority MEDIUM 48CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view, overwrite, or append to arbitrary files on the system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00424 36th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMTivoli Monitoring6.3.0.7 – 6.3.0.7 Service Pack 21—No fix listedCNA
  • Tivoli Monitoring VendorIBM Affected 6.3.0.7 – 6.3.0.7 Service Pack 21 Fixed in — No fix listed CNA

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:-:*:*:*:*:*:*6.3.0.7VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp1:*:*:*:*:*:*6.3.0.7 sp1VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp10:*:*:*:*:*:*6.3.0.7 sp10VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp11:*:*:*:*:*:*6.3.0.7 sp11VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp12:*:*:*:*:*:*6.3.0.7 sp12VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp13:*:*:*:*:*:*6.3.0.7 sp13VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp14:*:*:*:*:*:*6.3.0.7 sp14VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp15:*:*:*:*:*:*6.3.0.7 sp15VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp16:*:*:*:*:*:*6.3.0.7 sp16VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp17:*:*:*:*:*:*6.3.0.7 sp17VulnerableIBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:-:*:*:*:*:*:* Versions 6.3.0.7 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp1:*:*:*:*:*:* Versions 6.3.0.7 sp1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp10:*:*:*:*:*:* Versions 6.3.0.7 sp10 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp11:*:*:*:*:*:* Versions 6.3.0.7 sp11 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp12:*:*:*:*:*:* Versions 6.3.0.7 sp12 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp13:*:*:*:*:*:* Versions 6.3.0.7 sp13 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp14:*:*:*:*:*:* Versions 6.3.0.7 sp14 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp15:*:*:*:*:*:* Versions 6.3.0.7 sp15 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp16:*:*:*:*:*:* Versions 6.3.0.7 sp16 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp17:*:*:*:*:*:* Versions 6.3.0.7 sp17 Vulnerable ·IBM
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp18:*:*:*:*:*:*6.3.0.7 sp18VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp19:*:*:*:*:*:*6.3.0.7 sp19VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp2:*:*:*:*:*:*6.3.0.7 sp2VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp20:*:*:*:*:*:*6.3.0.7 sp20VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp21:*:*:*:*:*:*6.3.0.7 sp21VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp3:*:*:*:*:*:*6.3.0.7 sp3VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp4:*:*:*:*:*:*6.3.0.7 sp4VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp5:*:*:*:*:*:*6.3.0.7 sp5VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp6:*:*:*:*:*:*6.3.0.7 sp6VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp7:*:*:*:*:*:*6.3.0.7 sp7VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp8:*:*:*:*:*:*6.3.0.7 sp8VulnerableIBM
cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp9:*:*:*:*:*:*6.3.0.7 sp9VulnerableIBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp18:*:*:*:*:*:* Versions 6.3.0.7 sp18 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp19:*:*:*:*:*:* Versions 6.3.0.7 sp19 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp2:*:*:*:*:*:* Versions 6.3.0.7 sp2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp20:*:*:*:*:*:* Versions 6.3.0.7 sp20 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp21:*:*:*:*:*:* Versions 6.3.0.7 sp21 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp3:*:*:*:*:*:* Versions 6.3.0.7 sp3 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp4:*:*:*:*:*:* Versions 6.3.0.7 sp4 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp5:*:*:*:*:*:* Versions 6.3.0.7 sp5 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp6:*:*:*:*:*:* Versions 6.3.0.7 sp6 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp7:*:*:*:*:*:* Versions 6.3.0.7 sp7 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp8:*:*:*:*:*:* Versions 6.3.0.7 sp8 Vulnerable ·IBM
  • cpe:2.3:a:ibm:tivoli_monitoring:6.3.0.7:sp9:*:*:*:*:*:* Versions 6.3.0.7 sp9 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    IBM Tivoli Monitoring — ibm.com/support/pages/node/7249694

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-02943 IBM Tivoli Monitoring is vulnerable to unauthenticated file read and write operationsPriority LOW 39
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-3356
  2. 2026-10-03 Alias added: GHSA-fw76-qjj6-w857

References

Patch 1

  • TI-2025-02945 IBM Tivoli Monitoring code execution CVSS 3.1CRITICAL 9.8
  • TI-2012-04075 Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1… CVSS 2.0HIGH 9.3
  • TI-2012-04074 Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier… CVSS 2.0HIGH 9.3
  • TI-2012-04073 Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier… CVSS 2.0HIGH 9.3
  • TI-2017-01388 Code injection in IBM Tivoli Monitoring V6 CVSS 3.0CRITICAL 9.8
  • TI-2015-06160 The portal client in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5… CVSS 3.0CRITICAL 9.9
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences