CVE-2025-36026
BaseFortify
Publication date: 2025-06-28
Last updated on: 2025-07-01
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | datacap | 9.1.7 |
| ibm | datacap | 9.1.8 |
| ibm | datacap | 9.1.9 |
| ibm | datacap_navigator | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-614 | The Secure attribute for sensitive cookies in HTTPS sessions is not set. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in IBM Datacap versions 9.1.7, 9.1.8, and 9.1.9 occurs because the software does not set the 'secure' attribute on authorization tokens or session cookies. As a result, attackers can obtain these cookie values by tricking users into clicking on HTTP links or by placing such links on websites the user visits. Since the cookies are sent over insecure HTTP connections, attackers can intercept and capture them by snooping on the network traffic. [1]
How can this vulnerability impact me? :
The vulnerability can allow attackers to steal session cookies or authorization tokens by intercepting them over insecure HTTP connections. This can lead to unauthorized access to user sessions or accounts, potentially allowing attackers to impersonate users or gain access to sensitive information within the IBM Datacap environment. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves IBM Datacap not setting the 'secure' attribute on authorization tokens or session cookies, which can be detected by inspecting the cookies set by the application. You can use browser developer tools or network traffic analysis tools (e.g., Wireshark) to check if session cookies lack the 'secure' flag. Additionally, commands like 'curl -I http://your-datacap-server' can be used to inspect HTTP headers and cookies for the absence of the 'secure' attribute. There are no specific detection commands provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
IBM strongly recommends applying the provided fix immediately, specifically upgrading to IBM Datacap version 9.1.9 Interim Fix 007 or later, which addresses this vulnerability. No workarounds or mitigations are available, so patching is the only immediate step to mitigate the risk. [1]