CVE-2025-13723: IBM Sterling PEM Info Disclosure Flaw

CVE-2025-13723 Overview

IBM Sterling Partner Engagement Manager contains an information disclosure vulnerability that allows attackers to obtain sensitive user information using expired access tokens. This authentication flaw affects multiple versions of the enterprise partner management platform, potentially exposing confidential business data to unauthorized parties.

Critical Impact

Attackers can leverage expired access tokens to bypass authentication controls and access sensitive user information, compromising confidentiality of enterprise partner data.

Affected Products

• IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 (Essentials and Standard editions)
• IBM Sterling Partner Engagement Manager 6.2.4.0 through 6.2.4.2 (Essentials and Standard editions)
• Linux Kernel (underlying operating system)

Discovery Timeline

• 2026-03-13 - CVE-2025-13723 published to NVD
• 2026-03-18 - Last updated in NVD database

Technical Details for CVE-2025-13723

Vulnerability Analysis

This vulnerability stems from improper handling of expired access tokens within IBM Sterling Partner Engagement Manager's authentication framework. The application fails to properly invalidate or reject authentication requests made with access tokens that have exceeded their intended validity period. As a result, an attacker who has obtained a previously valid access token can continue to use it even after expiration to retrieve sensitive user information from the system.

The network-accessible nature of this vulnerability means that remote attackers can exploit this flaw without requiring any prior authentication or user interaction. The impact is limited to confidentiality, as the vulnerability allows unauthorized read access to sensitive data but does not enable modification of data or disruption of service availability.

Root Cause

The root cause of this vulnerability is classified under CWE-324 (Use of a Key Past its Expiration Date). The application's token validation mechanism does not properly verify the expiration timestamp of access tokens during the authentication process. When an expired token is presented, the system processes it as valid rather than rejecting the authentication attempt, allowing continued access to protected resources.

Attack Vector

The attack vector is network-based, requiring no privileges, user interaction, or complex conditions to exploit. An attacker who has previously obtained a valid access token—through interception, theft, or other means—can continue to use that token indefinitely after it should have expired. The attacker sends HTTP requests to the Sterling Partner Engagement Manager API endpoints with the expired token in the authorization header, and the system incorrectly validates and processes these requests.

The vulnerability allows the attacker to query user information endpoints and extract sensitive data that should only be accessible to authenticated and authorized users with valid credentials.

Detection Methods for CVE-2025-13723

Indicators of Compromise

• Unusual API requests using access tokens that should have expired based on your token lifetime policy
• Authentication log entries showing successful access with tokens issued significantly before the access time
• Repeated access patterns from the same token ID over extended periods exceeding normal token validity windows

Detection Strategies

• Implement logging that captures token issuance timestamps and compares them against access timestamps
• Monitor for authentication success events where the token age exceeds the configured expiration period
• Enable audit logging on Sterling Partner Engagement Manager to track all API authentication attempts
• Review access logs for patterns indicating token reuse beyond expected validity periods

Monitoring Recommendations

• Configure alerting for any authentication attempts using tokens older than your maximum token lifetime
• Implement centralized log collection for Sterling Partner Engagement Manager authentication events
• Establish baseline metrics for normal token usage patterns to identify anomalous behavior
• Enable SentinelOne Singularity Platform monitoring on systems running Sterling Partner Engagement Manager for endpoint-level visibility

How to Mitigate CVE-2025-13723

Immediate Actions Required

• Apply the IBM security update as referenced in the IBM Support Advisory
• Review access logs for any evidence of exploitation using expired tokens
• Force token refresh for all active user sessions after applying the patch
• Audit user accounts for unauthorized access that may have occurred during the exposure window

Patch Information

IBM has released a security update to address this vulnerability. Organizations running affected versions of Sterling Partner Engagement Manager should upgrade to the latest patched version as soon as possible. Detailed patch information and download links are available in the IBM Support Advisory.

Workarounds

• Reduce access token validity periods to minimize the window of exploitation
• Implement additional network-level access controls to restrict API access to trusted sources
• Enable IP-based session binding to prevent token reuse from different network locations
• Consider implementing a token blacklist mechanism at the application gateway level to manually invalidate suspicious tokens

# Review Sterling Partner Engagement Manager authentication configuration
# Verify token expiration settings and enforcement
# Example: Check application server logs for token validation events
grep -i "token" /var/log/sterling-pem/auth.log | grep -i "expired"

# Monitor for unusual access patterns
tail -f /var/log/sterling-pem/access.log | grep -E "Authorization|Bearer"