CVE-2025-33135: IBM Financial Transaction Manager for ACH Services and Check Services is impacted by multiple vulnerabilities
IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform 3.0.0.0 through 3.0.5.4 Interim Fix 027 IBM Financial Transaction Manager for Check Services v3 (Multiplatforms) is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Other sources
The jackson-core package is vulnerable to a Denial of Service (DoS) attack. The methods in the classes listed below fail to restrict input size when performing numeric type conversions. A remote attacker can exploit this vulnerability by causing the application to deserialize data containing certain numeric types with large values. Deserializing many of the aforementioned objects may cause the application to exhaust all available resources, resulting in a DoS condition.
— IBM
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-33135?
CVE-2025-33135 has been assigned a severity rating that indicates a high impact on the confidentiality, integrity, and availability of the impacted systems.
How do I fix CVE-2025-33135?
To fix CVE-2025-33135, upgrade IBM Financial Transaction Manager for ACH Services and Check Services to the latest version that addresses this vulnerability.
Which versions of IBM Financial Transaction Manager are affected by CVE-2025-33135?
CVE-2025-33135 affects versions from 3.0.0.0 to 3.0.5.4 Interim Fix 027 of IBM Financial Transaction Manager for ACH Services and Check Services.
What are the potential risks of CVE-2025-33135?
The risks associated with CVE-2025-33135 include unauthorized access to financial transaction data and potential disruption of service.
Is there a known exploit for CVE-2025-33135?
As of now, there are no publicly known exploits specific to CVE-2025-33135, but the vulnerabilities should be taken seriously and addressed promptly.