CVE-2025-36162
published 2025-09-02CVE-2025-36162: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) 8.1 before 8.1.2.2 could allow an authenticated user to obtain sensitive information about configuration on the…
PriorityP419medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.24%
14.3th percentile
IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) 8.1 before 8.1.2.2 could allow an authenticated user to obtain sensitive information about configuration on the system.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | devops_deploy | >= 8.1.0.0 < 8.1.2.2 | 8.1.2.2 |
| ibm | urbancode_deploy | 8.1 – 8.1.2.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
IBM UrbanCode Deploy up to 8.1.2.1 Configuration information expsure
vuldb·2026-10-02·CVSS 4.3
CVE-2025-36162 [MEDIUM] IBM UrbanCode Deploy up to 8.1.2.1 Configuration information expsure
A vulnerability categorized as problematic has been discovered in IBM UrbanCode Deploy up to 8.1.2.1. This impacts an unknown function of the component Configuration Handler. Such manipulation leads to exposure of sensitive system information to an unauthorized control sphere.
This vulnerability is uniquely identified as CVE-2025-36162. The attack can be launched remotely. No exploit exists.
It is advisable to upgrade the affected component.
GHSA
GHSA-xpxw-r4r3-r7qf: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) 8
ghsa_unreviewed·2025-09-02
CVE-2025-36162 [MEDIUM] CWE-497 GHSA-xpxw-r4r3-r7qf: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) 8
IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) 8.1 before 8.1.2.2 could allow an authenticated user to obtain sensitive information about configuration on the system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-09-02
Published