High severity · published Jul 23, 2025
CVE-2025-33020
IBM Engineering Systems Design Rhapsody information disclosure
7.5
CVSS
0.1%
EPSS
No
On KEV
Description
IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 transmits sensitive information without encryption that could allow an attacker to obtain highly sensitive information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Engineering Systems Design Rhapsody · IBM
9.0.2, 10.0, 10.0.1 · source: vendor, NVD
Affected product
ES
Engineering Systems Design Rhapsody
IBM
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-33020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-33020
Vendor Advisory
https://www.ibm.com/support/pages/node/7240374
More from Engineering Systems Design Rhapsody
8.8
CVE-2025-33077
IBM Engineering Systems Design Rhapsody code execution
8.8
CVE-2025-33076
IBM Engineering Systems Design Rhapsody code execution
5.4
CVE-2021-20357
IBM Jazz Foundation products is vulnerable to cross-site scripting
5.4
CVE-2020-4865
IBM Jazz Foundation products is vulnerable to cross-site scripting
5.4
CVE-2020-4855
IBM Jazz Foundation products is vulnerable to cross-site scripting