{"id":"CVE-2025-36157","aliases":["EUVD-2025-25663","GHSA-7hxx-86w9-pq4x"],"status":"published","title":"IBM Engineering Lifecycle Management incorrect authorization","description":"IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00636,"percentile":0.50787,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2025-08-24T01:14:41Z","modified":"2026-06-17T09:14:33Z","products":[{"vendor":"ibm","product":"engineering lifecycle management"},{"vendor":"ibm","product":"jazz_foundation"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7242925","tags":["vendor-advisory","patch","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-36157"},{"url":"https://github.com/advisories/GHSA-7hxx-86w9-pq4x"}],"sources":{"cve":[{"id":"CVE-2025-36157","title":"IBM Engineering Lifecycle Management incorrect authorization","description":"IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions.","status":"published","published":"2025-08-24T01:14:41.359Z","modified":"2026-02-26T17:48:14.12Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:32:45.503988Z"}],"euvd":[{"id":"EUVD-2025-25663","description":"IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions.","status":"published","published":"2025-08-24T01:14:41Z","modified":"2026-02-26T17:48:14Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:22.388505Z"}],"ghsa":[{"id":"GHSA-7hxx-86w9-pq4x","title":"IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004...","description":"IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions.","status":"published","published":"2025-08-24T03:30:29Z","modified":"2025-08-24T03:30:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:03:23.773614Z"}],"nvd":[{"id":"CVE-2025-36157","description":"IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions.","status":"published","published":"2025-08-24T02:15:44.1Z","modified":"2026-06-17T09:14:33.543Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:11:25.261243Z"}]}}