---
id: CVE-2025-36249
title: >-
  IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the
  secure attribute on authorization tokens or session cookies
summary: >-
  IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the
  secure attribute on authorization tokens or session cookies. Attackers may be
  able to get the cookie values by sending a http:// link to a user or by
  planting this…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-614
vendor: ibm
product: jazz_for_service_management
affected:
  - 'jazz_for_service_management >= 1.1.3.0, < 1.1.3.26'
patched:
  - jazz_for_service_management 1.1.3.26
published: '2025-10-31'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T21:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-36249'
references:
  - url: 'https://www.ibm.com/support/pages/node/7249820'
    label: psirt@us.ibm.com
tags:
  - nvd
epss: 0.00157
epssPercentile: 0.04272
ingestedAt: '2026-10-07T21:54:14.918Z'
---

## Overview

IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

## Affected

- `jazz_for_service_management >= 1.1.3.0, < 1.1.3.26`

## Remediation

Upgrade past the affected range:

- `jazz_for_service_management 1.1.3.26`