CVE-2025-2138

LowCVSS 3.5/10Last modified Oct 8, 2026

Description

IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1

could allow an authenticated user on the network to delete comments from other users due to client-side enforcement of server-side security.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-602

Affected software

VendorProductVersions
IBMEngineering Requirements Management Doors Next7.0.2; 7.0.3; 7.1

References

Timeline

Published
Oct 12, 2025
Last modified
Oct 8, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-213806.5Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network.CVE-2025-213817.8Microsoft Excel Remote Code Execution VulnerabilityCVE-2025-213827.8Windows Graphics Component Elevation of Privilege VulnerabilityCVE-2025-213835.5Microsoft Excel Information Disclosure VulnerabilityCVE-2025-213848.8An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privilegeCVE-2025-213856.5A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a networkCVE-2025-213867.8Microsoft Excel Remote Code Execution VulnerabilityCVE-2025-213877.8Microsoft Excel Remote Code Execution VulnerabilityCVE-2025-213897.5Uncontrolled resource consumption in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to deny service overCVE-2025-21393.5IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews CVE-2025-213907.8Microsoft Excel Remote Code Execution VulnerabilityCVE-2025-213917.1Windows Storage Elevation of Privilege Vulnerability
CVE-2025-2138: Low severity, CVSS 3.5 | Vulnix