SB2025080412 - Multiple vulnerabilities in IBM Cloud Object System

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025080412

SB2025080412 - Multiple vulnerabilities in IBM Cloud Object System

Published: August 4, 2025

Security Bulletin ID SB2025080412
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Security features bypass (CVE-ID: CVE-2025-22228)

The vulnerability allows a remote attacker to gain unauthorized access to the application.

The vulnerability exists due to BCryptPasswordEncoder does not properly enforce maximum password length and will return "true" for passwords larger than 72 characters as long as the first 72 characters are the same. This can be used set weak passwords that can be easily brute-forced.


2) Input validation error (CVE-ID: CVE-2025-27516)

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to sandbox breakout through attr filter selecting format method. A local user can execute arbitrary code on the system.


Remediation

Install update from vendor's website.

References