Medium severity · published Oct 12, 2025
CVE-2025-2140
IBM Engineering Requirements Management Doors Next spoofing
5.7
CVSS
0.1%
EPSS
No
On KEV
Description
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ER
Engineering Requirements Management Doors Next · IBM
7.0.2; 7.0.3; 7.1 · source: vendor, NVD
Affected product
ER
Engineering Requirements Management Doors Next
IBM
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2140
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2140
Vendor Advisory
https://www.ibm.com/support/pages/node/7247716
More from Engineering Requirements Management Doors Next
8.2
CVE-2023-45192
IBM Engineering Requirements Management DOORS Next XML external entity injection
7.5
CVE-2024-41771
IBM Engineering Requirements Management DOORS Next information disclosure
7.5
CVE-2024-41770
IBM Engineering Requirements Management DOORS Next information disclosure
7.5
CVE-2020-4965
IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information
6.5
CVE-2025-33096
IBM Engineering Requirements Management Doors Next denial of service