PT-2025-27282 · Ibm · Ibm Datacap

Published 2025-06-28 · Updated 2025-06-28 · CVE-2025-36026

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: IBM Datacap versions 9.1.7 through 9.1.9

Description: The issue is related to the improper handling of authorization tokens and session cookies, as the software does not set the secure attribute on these cookies or tokens. Attackers may be able to obtain the cookie values by sending a http link to a user or by planting this link in a site the user visits, allowing them to snoop the traffic and obtain the cookie value.

Recommendations: For versions 9.1.7 through 9.1.9, consider setting the secure attribute on authorization tokens and session cookies manually until a patch is available. As a temporary workaround, restrict access to sensitive areas of the application that use these cookies to minimize the risk of exploitation. Avoid using insecure links (http) for sensitive transactions; instead, use secure links (https) to protect the cookie values from being intercepted.

Fix

Weakness Enumeration

CWE-614

Related Identifiers

BDU:2025-09841

CVE-2025-36026

Affected Products

Ibm Datacap

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-36026 · Security Note
• https://bdu.fstec.ru/vul/2025-09841 · Security Note
• https://osv.dev/vulnerability/CVE-2025-36026 · Vendor Advisory
• https://t.me/cvetracker/27282 · Telegram Post
• https://twitter.com/transilienceai/status/1938817871808995586 · Twitter Post
• https://ibm.com/support/pages/node/7238443 · Patch, Vendor Advisory
• https://t.me/cvenotify/126968 · Telegram Post
• https://twitter.com/CVEnew/status/1938792720128188591 · Twitter Post