CVE-2025-36069

Received Received - Intake

Session Fixation in IBM Storage TS4500 Library

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: IBM Corporation

Description

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2025-36069

EUVD

EUVD-2025-211135

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	Storage	TS4500 Library 1.1.1.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This vulnerability is an improper session management issue in IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3. After a user logs out, the system fails to invalidate their session, allowing an authenticated user to impersonate another user.

Impact Analysis

An attacker with valid credentials could exploit this to access another user's session, potentially gaining unauthorized access to sensitive data or performing actions on behalf of that user.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to potential data breaches or improper access controls.

Mitigation Strategies

Apply the latest IBM Storage TS4500 Library update to version 1.12.0.3 or later to address the session invalidation issue.

Hi! I’m here to help you understand CVE-2025-36069. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70