IBM Jazz for Service Management information disclosure_CVE-2025-36011

4.3 / 10

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Description

IBM Jazz for Service Management 1.1.3.0 through 1.1.3.24 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

Basic Information

ID CVE-2025-36011

Source ibm

Published Sep 9, 2025 at 19:32

Affected Product

Vendor IBM

Product Jazz for Service Management

Version 1.1.3.0

Affected Versions IBM Jazz for Service Management 1.1.3.0

CWE Classification

CWE-614

References

www.ibm.com /support/pages/node/7244357

{
    "lastseen": "",
    "description": "IBM Jazz for Service Management 1.1.3.0 through 1.1.3.24 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.",
    "published": "2025-09-09T19:32:16.786Z",
    "modified": "2025-09-09T19:32:16.786Z",
    "type": "cve",
    "title": "IBM Jazz for Service Management information disclosure",
    "source": "ibm",
    "references": "https://www.ibm.com/support/pages/node/7244357",
    "id": "CVE-2025-36011",
    "bulletinFamily": "",
    "cwe": [
        "CWE-614"
    ],
    "cvelist": null,
    "sourceData": "IBM Jazz for Service Management 1.1.3.0",
    "sourceHref": "",
    "cvss": {
        "score": 4.3,
        "severity": "MEDIUM",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Jazz for Service Management",
    "version": "1.1.3.0",
    "vendor": "IBM",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}