by Kastro
Paper/Archive/CVE-2025-36157

CVE-2025-36157

IBM Engineering Lifecycle Management — IBM Engineering Lifecycle Management incorrect authorization

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.5.505 × 2010.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions.

Affected

ProductAffectedFixed inSource
Engineering Lifecycle Management7.0.2 – 7.0.2 iFix035–CNA
Engineering Lifecycle Management7.0.3 – 7.0.3 iFix018–CNA
Engineering Lifecycle Management7.1.0 – 7.1.0 iFix004–CNA

Scores by source

ibm (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchibm.com/support/pages/node/7242925