CVE-2025-0152 is a cross-site scripting vulnerability (CWE-79) affecting IBM Engineering Requirements Management DOORS and DOORS Web Access versions 9.7.2.1 through 9.7.2.11 and 9.6.1.1 through 9.6.1.13. The vulnerability enables unauthenticated attackers to embed arbitrary JavaScript code in the web UI, which can alter intended functionality and potentially disclose credentials within a trusted session. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality and integrity with no impact on availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

An unauthenticated attacker can exploit this vulnerability to inject malicious JavaScript into the web interface of affected IBM DOORS products. This can lead to altered web UI behavior and potential disclosure of user credentials within a trusted session. The impact affects confidentiality and integrity but does not affect availability. The vulnerability could facilitate further attacks if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply any recommended workarounds or mitigations provided by IBM. Monitor IBM's security advisories for updates and consider restricting access to the affected web interfaces to trusted users only.