CVE-2025-27909: IBM Concert Software cross-origin resource sharing
IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.
Other sources
IBM Concert Software uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27909?
CVE-2025-27909 is categorized as a critical vulnerability due to its potential for allowing unauthorized privileged actions.
How do I fix CVE-2025-27909?
To fix CVE-2025-27909, you should restrict cross-origin resource sharing (CORS) to only trusted domains in IBM Concert Software.
Which versions of IBM Concert Software are affected by CVE-2025-27909?
CVE-2025-27909 affects IBM Concert Software versions 1.0.0 through 1.1.0.
What types of attacks can CVE-2025-27909 allow?
CVE-2025-27909 can allow attackers to execute privileged actions on behalf of users due to improper CORS configuration.
Is there a workaround for CVE-2025-27909 until a patch is available?
As a workaround for CVE-2025-27909, you can temporarily disable CORS or implement strict domain whitelisting.