CVE-2025-36011: IBM Jazz Service Management Auth Bypass

CVE-2025-36011 Overview

CVE-2025-36011 affects IBM Jazz for Service Management versions 1.1.3.0 through 1.1.3.24. The product fails to set the Secure attribute on authorization tokens and session cookies. This omission allows browsers to transmit sensitive cookies over unencrypted HTTP connections. An attacker who convinces a user to click an http:// link, or who plants such a link on a visited page, can capture the cookie in cleartext by sniffing network traffic. The flaw maps to [CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute]. IBM published a support advisory addressing the issue.

Critical Impact
Attackers positioned on the network path can intercept session cookies transmitted over cleartext HTTP, enabling session hijacking against authenticated IBM Jazz for Service Management users.

Affected Products

IBM Jazz for Service Management 1.1.3.0
IBM Jazz for Service Management 1.1.3.x through 1.1.3.24
Deployments exposing the web interface to untrusted networks

Discovery Timeline

2025-09-09 - CVE-2025-36011 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36011

Vulnerability Analysis

IBM Jazz for Service Management issues authorization tokens and session cookies without the Secure attribute. The Secure flag instructs browsers to transmit a cookie only over HTTPS connections. Without it, the browser attaches the cookie to any request matching the domain scope, including plaintext HTTP requests.

This behavior enables a passive network attacker to capture authenticated session material. The attacker does not need to compromise the server or the client directly. User interaction is required, since the victim must follow an http:// link or load a resource that triggers an HTTP request to the vulnerable host.

Once the cookie is captured, the attacker can replay it against the application and impersonate the victim within the scope of that session. The confidentiality impact is limited to information the compromised session can access.

Root Cause

The application server sets Set-Cookie headers for authentication and session tokens without appending the Secure directive. Cookie scoping relies solely on domain and path attributes, so the browser will send the cookie over any transport, including HTTP. This is a classic instance of [CWE-614].

Attack Vector

Exploitation proceeds in three stages. First, the attacker crafts an http:// URL pointing at the Jazz for Service Management host and delivers it through phishing, forum posts, or a compromised third-party site. Second, the authenticated victim's browser issues the HTTP request and attaches the session cookie. Third, an attacker with access to any intermediate network segment, including public Wi-Fi or a compromised router, reads the cookie from the wire.

Exploitation does not require elevated privileges or authentication on the attacker side. See the IBM Support Page for vendor-provided technical detail.

Detection Methods for CVE-2025-36011

Indicators of Compromise

HTTP requests to the Jazz for Service Management host on port 80 carrying JSESSIONID or authorization cookies in cleartext
Session activity from IP addresses or geolocations inconsistent with the legitimate user's baseline
Concurrent sessions using the same authorization token from distinct source addresses

Detection Strategies

Inspect Set-Cookie response headers from the application and confirm whether the Secure attribute is present on session and authorization cookies
Monitor web server access logs for authenticated requests received over HTTP rather than HTTPS
Correlate authentication events with source IP changes within short time windows to surface session replay

Monitoring Recommendations

Enable full request logging on the reverse proxy or load balancer fronting Jazz for Service Management and alert on plaintext traffic to the service hostname
Deploy TLS inspection at the network egress boundary and flag any HTTP traffic destined for internal application URLs
Track authorization token reuse across distinct user agents and network segments as a session hijack signal

How to Mitigate CVE-2025-36011

Immediate Actions Required

Apply the fix documented on the IBM Support Page for Jazz for Service Management
Force HTTPS on all application endpoints and disable listeners on port 80, or configure them to issue HTTP 301 redirects to HTTPS
Invalidate all active sessions after patching to revoke any cookies that may have been captured while the flaw was present

Patch Information

IBM has published guidance for CVE-2025-36011 through its support portal. Refer to the IBM Support Page for the fix pack applicable to versions 1.1.3.0 through 1.1.3.24 and confirm that upgraded builds emit Set-Cookie headers containing the Secure and HttpOnly attributes.

Workarounds

Configure the front-end web server or reverse proxy to rewrite outgoing Set-Cookie headers and append the Secure attribute until the vendor patch is applied
Enforce HTTP Strict Transport Security (HSTS) with a long max-age and includeSubDomains on the application hostname to prevent browsers from issuing plaintext requests
Restrict access to the Jazz for Service Management interface to trusted network segments or a VPN to reduce exposure to passive network attackers

bash

# Example reverse proxy configuration to enforce HTTPS and secure cookies
# Apache httpd
Header edit Set-Cookie ^(.*)$ $1;Secure;HttpOnly
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]