CVE-2025-36364

Received Received - Intake

Local Cache Exposure in IBM DevOps Plan

Publication date: 2026-03-03

Last updated on: 2026-03-04

Assigner: IBM Corporation

Description

IBM DevOps Plan 3.0.0 through 3.0.5 allows web page cache to be stored locally which can be read by another user on the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-03

Last Modified

2026-03-04

Generated

2026-07-06

AI Q&A

2026-03-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-36364

EUVD

EUVD-2025-208255

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	devops_plan	From 3.0.0 (inc) to 3.0.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-525	The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.

Attack-Flow Graph

Executive Summary

The IBM DevOps Plan versions 3.0.0 through 3.0.5 have a vulnerability where sensitive data is transmitted via request query parameters and cached locally by the web browser.

This cached data can then be accessed by other users on the same system, potentially exposing sensitive information.

This issue is classified under CWE-525: Use of Web Browser Cache Containing Sensitive Information.

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information because cached web page data containing sensitive details can be read by other users on the same system.

Since the attack vector is local with low complexity and no privileges or user interaction required, an attacker with access to the same system could easily exploit this to gain confidential information.

The confidentiality impact is high, but there is no impact on integrity or availability.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

The vulnerability in IBM DevOps Plan versions 3.0.0 through 3.0.5 can be remediated by upgrading to version 3.0.6.

No workarounds or mitigations are provided other than the upgrade.

Customers are advised to assess the impact in their environments and subscribe to IBM notifications for future security alerts.

Hi! I’m here to help you understand CVE-2025-36364. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70