{"id":"CVE-2025-2140","title":"IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.","summary":"IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.","severity":"medium","cvss":5.7,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-346"],"vendor":"ibm","product":"engineering_requirements_management_doors_next","affected":["engineering_requirements_management_doors_next = 7.0.2","engineering_requirements_management_doors_next = 7.0.3","engineering_requirements_management_doors_next = 7.1"],"published":"2025-10-12","updated":"2026-10-08","sourceUpdated":"2026-10-08T13:10:00.200","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-2140","references":[{"url":"https://www.ibm.com/support/pages/node/7247716","label":"psirt@us.ibm.com"}],"tags":["nvd"],"epss":0.00124,"epssPercentile":0.01884,"ingestedAt":"2026-10-08T13:42:55.119Z","slug":"CVE-2025-2140","body":"## Overview\n\nIBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.\n\n## Affected\n\n- `engineering_requirements_management_doors_next = 7.0.2`\n- `engineering_requirements_management_doors_next = 7.0.3`\n- `engineering_requirements_management_doors_next = 7.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":31.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}