CVE-2025-36249: jazz for service management from 1.1.3.0 (inclusive), before 1.1.3.26 (exclusive); +1 more affected products

Affected technology

jazz for service management · from 1.1.3.0 (inclusive), before 1.1.3.26 (exclusive)
ibm

Jazz for Service Management · 1.1.3.0 through 1.1.3.25
IBM

Description’s affected range: through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. Vendor/CNA’s CVSS 3.1 assessment (base score 3.7/10) rates confidentiality impact as low; integrity and availability impact as none. NVD’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality impact as low; integrity and availability impact as none.