IBM UrbanCode Deploy/DevOps Deploy up to 7.1.2.21/7.2.3.14/7.3.2.9 log file

Summaryinfo

A vulnerability was found in IBM UrbanCode Deploy and DevOps Deploy up to 7.1.2.21/7.2.3.14/7.3.2.9. It has been declared as problematic. Impacted is an unknown function. Executing a manipulation can lead to log file. This vulnerability is handled as CVE-2025-1998. It is possible to launch the attack on the local host. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in IBM UrbanCode Deploy and DevOps Deploy up to 7.1.2.21/7.2.3.14/7.3.2.9. This vulnerability affects some unknown processing. The manipulation with an unknown input leads to a log file vulnerability. The CWE definition for the vulnerability is CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. As an impact it is known to affect confidentiality. CVE summarizes:

IBM UrbanCode Deploy (UCD) through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 and 8.1 through 8.1 stores potentially sensitive authentication token information in log files that could be read by a local user.

The advisory is shared for download at ibm.com. This vulnerability was named CVE-2025-1998 since 03/05/2025. The exploitation appears to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• IBM

Name

• DevOps Deploy
• UrbanCode Deploy

Version

• 7.1.2.0
• 7.1.2.1
• 7.1.2.2
• 7.1.2.3
• 7.1.2.4
• 7.1.2.5
• 7.1.2.6
• 7.1.2.7
• 7.1.2.8
• 7.1.2.9
• 7.1.2.10
• 7.1.2.11
• 7.1.2.12
• 7.1.2.13
• 7.1.2.14
• 7.1.2.15
• 7.1.2.16
• 7.1.2.17
• 7.1.2.18
• 7.1.2.19
• 7.1.2.20
• 7.1.2.21
• 7.2.3.0
• 7.2.3.1
• 7.2.3.2
• 7.2.3.3
• 7.2.3.4
• 7.2.3.5
• 7.2.3.6
• 7.2.3.7
• 7.2.3.8
• 7.2.3.9
• 7.2.3.10
• 7.2.3.11
• 7.2.3.12
• 7.2.3.13
• 7.2.3.14
• 7.3.2.0
• 7.3.2.1
• 7.3.2.2
• 7.3.2.3
• 7.3.2.4
• 7.3.2.5
• 7.3.2.6
• 7.3.2.7
• 7.3.2.8
• 7.3.2.9

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion