CVE-2025-2140
MEDIUMCVSS 5.7/10EPSS 0.11%
Last modified
CVE-2025-2140 is a medium-severity vulnerability rated 5.7/10 on the CVSS scale. IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.. EPSS estimates a 0.11% chance of exploitation in the next 30 days.
Description
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.
Metrics
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Engineering Requirements Management Doors Next | 7.0.2 |
| Ibm | Engineering Requirements Management Doors Next | 7.0.3 |
| Ibm | Engineering Requirements Management Doors Next | 7.1 |
References
- https://www.ibm.com/support/pages/node/7247716Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-2140?
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.
How severe is CVE-2025-2140?
CVE-2025-2140 has a CVSS score of 5.7/10 (MEDIUM severity). The EPSS model estimates a 0.11% probability of exploitation in the next 30 days.
How do I fix CVE-2025-2140?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-21393Microsoft SharePoint Server Spoofing Vulnerability6.3
- CVE-2025-21394Microsoft Excel Remote Code Execution Vulnerability7.8
- CVE-2025-21395Microsoft Access Remote Code Execution Vulnerability7.8
- CVE-2025-21396Missing authorization in Microsoft Account allows an unautho…8.2
- CVE-2025-21397Microsoft Office Remote Code Execution Vulnerability7.8
- CVE-2025-21399Microsoft Edge (Chromium-based) Update Elevation of Privileg…7.4
- CVE-2025-21400Microsoft SharePoint Server Remote Code Execution Vulnerabil…8
- CVE-2025-21401Microsoft Edge (Chromium-based) Security Feature Bypass Vuln…4.5
- CVE-2025-21402Microsoft Office OneNote Remote Code Execution Vulnerability7.8
- CVE-2025-21403On-Premises Data Gateway Information Disclosure Vulnerabilit…6.4
- CVE-2025-21404Microsoft Edge (Chromium-based) Spoofing Vulnerability4.3
- CVE-2025-21405Visual Studio Elevation of Privilege Vulnerability7.3
Are you affected by CVE-2025-2140?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST