7.8 CVE-2025-1331
IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the gets function.
https://nvd.nist.gov/vuln/detail/CVE-2025-1331
Categories
CWE-242 : Use of Inherently Dangerous Function
Certain functions behave in dangerous ways regardless of how they are used. Functions in this category were often implemented without taking security concerns into account. The gets() function is unsafe because it does not perform bounds checking on the size of its input. An attacker can easily send arbitrarily-sized input to gets() and overflow the destination buffer. Similarly, the >> operator is unsafe to use when reading into a statically-allocated character array because it does not perform bounds checking on the size of its input. An attacker can easily send arbitrarily-sized input to the >> operator and overflow the destination buffer.
CWE-NVD-noinfo
References
psirt@us.ibm.com
| https://www.ibm.com/support/pages/node/7232923 Vendor Advisory |
| https://www.ibm.com/support/pages/node/7232924 Vendor Advisory |
CPE
| cpe | start | end |
|---|---|---|
| Configuration 1 | ||
| AND | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:-:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_1:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_10:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_11:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_12:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_13:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_14:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_15:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_16:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_17:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_18:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_19:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_2:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_20:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_21:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_22:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_23:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_24:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_3:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_4:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_5:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_6:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_7:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_8:*:*:standard:*:*:* | ||
| cpe:2.3:a:ibm:cics_tx:11.1.0.0:interim_fix_9:*:*:standard:*:*:* | ||
| Running on/with | ||
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | ||
REMEDIATION
EXPLOITS
Exploit-db.com
| id | description | date | |
|---|---|---|---|
| No known exploits | |||
POC Github
| Url |
|---|
| No known exploits |
Other Nist (github, ...)
| Url |
|---|
| No known exploits |
CAPEC
Common Attack Pattern Enumerations and Classifications
| id | description | severity |
|---|---|---|
| No entry | ||
Cybersecurity needs ?
Strengthen software security from the outset with our DevSecOps expertise
Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.
