CVE-2025-36157 - Vulnerability Details - OpenCVE

IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00099.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Ibm	Jazz Foundation

No data.

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7242925

History

Tue, 26 Aug 2025 15:00:00 +0000

Type	Values Removed	Values Added
Title	IBM Jazz Foundation incorrect authorization	IBM Engineering Lifecycle Management incorrect authorization

Mon, 25 Aug 2025 12:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sun, 24 Aug 2025 01:30:00 +0000

Type	Values Removed	Values Added
Description		IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions.
Title		IBM Jazz Foundation incorrect authorization
First Time appeared		Ibm Ibm jazz Foundation
Weaknesses		CWE-863
CPEs		cpe:2.3:a:ibm:jazz_foundation:7.0.2:::::::* cpe:2.3:a:ibm:jazz_foundation:7.0.2:ifix035:::::: cpe:2.3:a:ibm:jazz_foundation:7.0.3:::::::* cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix018:::::: cpe:2.3:a:ibm:jazz_foundation:7.1.0:::::::* cpe:2.3:a:ibm:jazz_foundation:7.1.0:ifix004::::::
Vendors & Products		Ibm Ibm jazz Foundation
References		https://www.ibm.com/support/pages/node/7242925
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2025-08-24T01:14:41.359Z

Updated: 2025-08-26T14:46:31.452Z

Reserved: 2025-04-15T21:16:20.813Z

Link: CVE-2025-36157

Vulnrichment

Updated: 2025-08-25T11:34:51.711Z

NVD

Status : Awaiting Analysis

Published: 2025-08-24T02:15:44.100

Modified: 2025-08-25T20:24:45.327

Link: CVE-2025-36157

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-36157", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:16:20.813Z", "datePublished": "2025-08-24T01:14:41.359Z", "dateUpdated": "2025-08-26T14:46:31.452Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:jazz_foundation:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:jazz_foundation:7.0.2:ifix035:*:*:*:*:*:*", "cpe:2.3:a:ibm:jazz_foundation:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix018:*:*:*:*:*:*", "cpe:2.3:a:ibm:jazz_foundation:7.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:jazz_foundation:7.1.0:ifix004:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Engineering Lifecycle Management", "vendor": "IBM", "versions": [{"lessThanOrEqual": "7.0.2 iFix035", "status": "affected", "version": "7.0.2", "versionType": "semver"}, {"lessThanOrEqual": "7.0.3 iFix018", "status": "affected", "version": "7.0.3", "versionType": "semver"}, {"lessThanOrEqual": "7.1.0 iFix004", "status": "affected", "version": "7.1.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions."}], "value": "IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-08-26T14:46:31.452Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7242925"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IBM strongly recommends addressing the vulnerability now by upgrading to iFixes detailed below:</p><p>IBM recommends customers on ELM 7.0, 7.0.1 or any version below 7.0.2 to upgrade your products to Maintenance release 7.0.2. Optionally, upgrade to the latest 7.1.0 version and apply below fix. </p><div><table><tbody><tr><td><strong>Affected Product(s)</strong></td><td><strong>Version(s)</strong></td><td><strong>Remediation/Fix/Instructions</strong></td></tr><tr><td>IBM Engineering Lifecycle Management - Jazz Foundation</td><td>7.0.2</td><td>Download and install <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Engineering&product=ibm/Rational/IBM+Engineering+Lifecycle+Management&release=7.0.2&platform=All&function=fixId&fixids=7.0.2-IBM-ELM-iFix035-sec&includeRequisites=1&includeSupersedes=0&downloadMethod=http\">7.0.2 iFix035-sec</a> or later</td></tr><tr><td>IBM Engineering Lifecycle Management - Jazz Foundation</td><td>7.0.3</td><td>Download and install <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Engineering&product=ibm/Rational/IBM+Engineering+Lifecycle+Management&release=7.0.3&platform=All&function=fixId&fixids=7.0.3-IBM-ELM-iFix018-sec&includeRequisites=1&includeSupersedes=0&downloadMethod=http\">7.0.3 iFix018-sec</a> or later</td></tr><tr><td>IBM Engineering Lifecycle Management - Jazz Foundation</td><td>7.1.0</td><td>Download and install <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Engineering&product=ibm/Rational/IBM+Engineering+Lifecycle+Management&release=7.1&platform=All&function=fixId&fixids=7.1-IBM-ELM-iFix004-sec&includeRequisites=1&includeSupersedes=0&downloadMethod=http&login=true\">7.1.0 iFix004-sec</a> or later</td></tr></tbody></table></div><div> </div><div><div>Apart from installing these iFixes, kindly perform the following additional step as mentioned below:</div><br><div>1. Set the Advanced property named \"setup.isRegistrationHandlerServiceOpen\" to \"False\" under Jazz Team Server (JTS) > Server Administration > Advanced property page and save your changes.</div></div>\n\n<br>"}], "value": "IBM strongly recommends addressing the vulnerability now by upgrading to iFixes detailed below:\n\nIBM recommends customers on ELM 7.0, 7.0.1 or any version below 7.0.2 to upgrade your products to Maintenance release 7.0.2. Optionally, upgrade to the latest 7.1.0 version and apply below fix. \n\nAffected Product(s)Version(s)Remediation/Fix/InstructionsIBM Engineering Lifecycle Management - Jazz Foundation7.0.2Download and install 7.0.2 iFix035-sec https://www.ibm.com/support/fixcentral/swg/downloadFixes \u00a0or laterIBM Engineering Lifecycle Management - Jazz Foundation7.0.3Download and install 7.0.3 iFix018-sec https://www.ibm.com/support/fixcentral/swg/downloadFixes \u00a0or laterIBM Engineering Lifecycle Management - Jazz Foundation7.1.0Download and install 7.1.0 iFix004-sec https://www.ibm.com/support/fixcentral/swg/downloadFixes \u00a0or later\n\n\u00a0\n\nApart from installing these iFixes, kindly perform the following additional step as mentioned below:\n\n\n1. Set the Advanced property named \"setup.isRegistrationHandlerServiceOpen\" to \"False\" under Jazz Team Server (JTS) > Server Administration > Advanced property page and save your changes."}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Engineering Lifecycle Management incorrect authorization", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-25T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2025-36157"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-26T03:55:28.420Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36157", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-25T11:32:49.619418Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-25T11:34:51.711Z"}}], "cna": {"title": "IBM Jazz Foundation incorrect authorization", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:jazz_foundation:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:jazz_foundation:7.0.2:ifix035:*:*:*:*:*:*", "cpe:2.3:a:ibm:jazz_foundation:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix018:*:*:*:*:*:*", "cpe:2.3:a:ibm:jazz_foundation:7.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:jazz_foundation:7.1.0:ifix004:*:*:*:*:*:*"], "vendor": "IBM", "product": "Jazz Foundation", "versions": [{"status": "affected", "version": "7.0.2", "versionType": "semver", "lessThanOrEqual": "7.0.2 iFix035"}, {"status": "affected", "version": "7.0.3", "versionType": "semver", "lessThanOrEqual": "7.0.3 iFix018"}, {"status": "affected", "version": "7.1.0", "versionType": "semver", "lessThanOrEqual": "7.1.0 iFix004"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now by upgrading to iFixes detailed below:\n\nIBM recommends customers on ELM 7.0, 7.0.1 or any version below 7.0.2 to upgrade your products to Maintenance release 7.0.2. Optionally, upgrade to the latest 7.1.0 version and apply below fix. \n\nAffected Product(s)Version(s)Remediation/Fix/InstructionsIBM Engineering Lifecycle Management - Jazz Foundation7.0.2Download and install 7.0.2 iFix035-sec https://www.ibm.com/support/fixcentral/swg/downloadFixes \u00a0or laterIBM Engineering Lifecycle Management - Jazz Foundation7.0.3Download and install 7.0.3 iFix018-sec https://www.ibm.com/support/fixcentral/swg/downloadFixes \u00a0or laterIBM Engineering Lifecycle Management - Jazz Foundation7.1.0Download and install 7.1.0 iFix004-sec https://www.ibm.com/support/fixcentral/swg/downloadFixes \u00a0or later\n\n\u00a0\n\nApart from installing these iFixes, kindly perform the following additional step as mentioned below:\n\n\n1. Set the Advanced property named \"setup.isRegistrationHandlerServiceOpen\" to \"False\" under Jazz Team Server (JTS) > Server Administration > Advanced property page and save your changes.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM strongly recommends addressing the vulnerability now by upgrading to iFixes detailed below:</p><p>IBM recommends customers on ELM 7.0, 7.0.1 or any version below 7.0.2 to upgrade your products to Maintenance release 7.0.2. Optionally, upgrade to the latest 7.1.0 version and apply below fix. </p><div><table><tbody><tr><td><strong>Affected Product(s)</strong></td><td><strong>Version(s)</strong></td><td><strong>Remediation/Fix/Instructions</strong></td></tr><tr><td>IBM Engineering Lifecycle Management - Jazz Foundation</td><td>7.0.2</td><td>Download and install <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Engineering&product=ibm/Rational/IBM+Engineering+Lifecycle+Management&release=7.0.2&platform=All&function=fixId&fixids=7.0.2-IBM-ELM-iFix035-sec&includeRequisites=1&includeSupersedes=0&downloadMethod=http\">7.0.2 iFix035-sec</a> or later</td></tr><tr><td>IBM Engineering Lifecycle Management - Jazz Foundation</td><td>7.0.3</td><td>Download and install <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Engineering&product=ibm/Rational/IBM+Engineering+Lifecycle+Management&release=7.0.3&platform=All&function=fixId&fixids=7.0.3-IBM-ELM-iFix018-sec&includeRequisites=1&includeSupersedes=0&downloadMethod=http\">7.0.3 iFix018-sec</a> or later</td></tr><tr><td>IBM Engineering Lifecycle Management - Jazz Foundation</td><td>7.1.0</td><td>Download and install <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Engineering&product=ibm/Rational/IBM+Engineering+Lifecycle+Management&release=7.1&platform=All&function=fixId&fixids=7.1-IBM-ELM-iFix004-sec&includeRequisites=1&includeSupersedes=0&downloadMethod=http&login=true\">7.1.0 iFix004-sec</a> or later</td></tr></tbody></table></div><div> </div><div><div>Apart from installing these iFixes, kindly perform the following additional step as mentioned below:</div><br><div>1. Set the Advanced property named \"setup.isRegistrationHandlerServiceOpen\" to \"False\" under Jazz Team Server (JTS) > Server Administration > Advanced property page and save your changes.</div></div>\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7242925", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions.", "supportingMedia": [{"type": "text/html", "value": "IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-08-24T01:14:41.359Z"}}}, "cveMetadata": {"cveId": "CVE-2025-36157", "state": "PUBLISHED", "dateUpdated": "2025-08-25T11:34:59.031Z", "dateReserved": "2025-04-15T21:16:20.813Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2025-08-24T01:14:41.359Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}