CVE-2025-36372

Summary

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information to an authenticated user from the monitoring and event tables.

Affected Software

VendorProductVersion RangeStatus
IBMDb211.5.0 <= 11.5.9affected
IBMDb212.1.0 <= 12.1.4affected

Weaknesses

  • CWE-538: CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory

Workarounds

Use DB2REMOTE alias. (DB2REMOTE is supported with LBAR only on 12.1 releases)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References