CVE-2025-36011
📋 TL;DR
IBM Jazz for Service Management versions 1.1.3.0 through 1.1.3.24 fail to set the secure attribute on authorization tokens and session cookies, allowing attackers to intercept these cookies via HTTP links. This affects organizations using vulnerable versions of IBM Jazz for Service Management, potentially exposing user sessions to unauthorized access.
💻 Affected Systems
- IBM Jazz for Service Management
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies via man-in-the-middle attacks on HTTP connections, leading to unauthorized access to the Jazz for Service Management application and potential data exposure or manipulation.
Likely Case
Session hijacking where attackers capture user cookies from HTTP traffic, gaining access to authenticated sessions within the application.
If Mitigated
With proper HTTPS enforcement and secure cookie attributes, the risk is reduced to minimal as cookies would only transmit over encrypted channels.
🎯 Exploit Status
Exploitation requires tricking users into clicking HTTP links or intercepting network traffic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.3.25 or later
Vendor Advisory: https://www.ibm.com/support/pages/node/7244357
Restart Required: No
Instructions:
1. Upgrade to IBM Jazz for Service Management version 1.1.3.25 or later. 2. Apply the fix as per IBM's instructions in the advisory.
🔧 Temporary Workarounds
Enforce HTTPS Only
allConfigure the application to use HTTPS exclusively and set secure cookie attributes.
Configure web server to redirect all HTTP traffic to HTTPS
Set secure flag on cookies in application configuration
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to the application
- Use web application firewalls (WAF) to monitor and block cookie theft attempts
🔍 How to Verify
Check if Vulnerable:
Check if cookies lack the secure attribute by inspecting HTTP responses or using browser developer tools.Check Version:
Check the application version in the admin console or via version files.Verify Fix Applied:
Verify that cookies now have the secure attribute set and are only transmitted over HTTPS.📡 Detection & Monitoring
Log Indicators:
- Unusual login patterns or session hijacking attempts in access logs
Network Indicators:
- HTTP traffic containing session cookies or unauthorized cookie interception
SIEM Query:
source="web_logs" AND (cookie_transmission="insecure" OR http_request="GET /login")