CVE-2025-36359: devops automation 1.0.1; +1 more affected products

Affected technology

devops automation · 1.0.1
ibm

devops loop · 1.0.2
ibm

Description’s affected range: 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says iBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate another user on the system. Vendor/CNA’s CVSS 3.1 assessment (base score 8.1/10) rates confidentiality and integrity impact as high; availability impact as none. NVD’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality and availability impact as none; integrity impact as high.