CVE-2025-36119 - Vulnerability Details - OpenCVE

IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web session hijacking vulnerability. An authenticated user without administrator privileges could exploit this vulnerability to perform actions in DCM as an administrator.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ibm	I

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7241008

History

Fri, 08 Aug 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 08 Aug 2025 14:30:00 +0000

Type	Values Removed	Values Added
Description		IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web session hijacking vulnerability. An authenticated user without administrator privileges could exploit this vulnerability to perform actions in DCM as an administrator.
Title		IBM i authentication bypass
First Time appeared		Ibm Ibm i
Weaknesses		CWE-290
CPEs		cpe:2.3:a:ibm:i:7.3:::::::* cpe:2.3:a:ibm:i:7.4:::::::* cpe:2.3:a:ibm:i:7.5:::::::* cpe:2.3:a:ibm:i:7.6:::::::*
Vendors & Products		Ibm Ibm i
References		https://www.ibm.com/support/pages/node/7241008
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2025-08-08T14:25:40.141Z

Updated: 2025-08-08T14:44:09.609Z

Reserved: 2025-04-15T21:16:17.124Z

Link: CVE-2025-36119

Vulnrichment

Updated: 2025-08-08T14:44:03.890Z

NVD

Status : Awaiting Analysis

Published: 2025-08-08T15:15:28.247

Modified: 2025-08-08T20:30:18.180

Link: CVE-2025-36119

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-36119", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:16:17.124Z", "datePublished": "2025-08-08T14:25:40.141Z", "dateUpdated": "2025-08-08T14:44:09.609Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "i", "vendor": "IBM", "versions": [{"status": "affected", "version": "7.3"}, {"status": "affected", "version": "7.4"}, {"status": "affected", "version": "7.5"}, {"status": "affected", "version": "7.6"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web session hijacking vulnerability. An authenticated user without administrator privileges could exploit this vulnerability to perform actions in DCM as an administrator."}], "value": "IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web session hijacking vulnerability. An authenticated user without administrator privileges could exploit this vulnerability to perform actions in DCM as an administrator."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-08-08T14:25:40.141Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7241008"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The issue can be fixed by applying a PTF to IBM i. IBM i 7.6, 7.5, 7.4, and 7.3 are addressed.<br>The IBM i PTF number for 5770-SS1 Option 34 contains the fix for the vulnerability.<br> <br>IBM i Release 5770-SS1<br>7.6 SJ06558 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06558\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06558</a><br>7.5 SJ06557 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06557\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06557</a><br>7.4 SJ06552 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06552\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06552</a><br>7.3 SJ06550 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06550\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06550<br></a><br><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/fixcentral\">https://www.ibm.com/support/fixcentral</a><br><br>Important note: IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products.<br>"}], "value": "The issue can be fixed by applying a PTF to IBM i. IBM i 7.6, 7.5, 7.4, and 7.3 are addressed.\nThe IBM i PTF number for 5770-SS1 Option 34 contains the fix for the vulnerability.\n \nIBM i Release 5770-SS1\n7.6 SJ06558 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06558 \n7.5\u00a0SJ06557 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06557 \n7.4\u00a0SJ06552 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06552 \n7.3 SJ06550 https://www.ibm.com/support/fixcentral \n\nImportant note: IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products."}], "source": {"discovery": "UNKNOWN"}, "title": "IBM i authentication bypass", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-08T14:43:43.552786Z", "id": "CVE-2025-36119", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-08T14:44:09.609Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36119", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-08T14:43:43.552786Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-08T14:44:03.890Z"}}], "cna": {"title": "IBM i authentication bypass", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "i", "versions": [{"status": "affected", "version": "7.3"}, {"status": "affected", "version": "7.4"}, {"status": "affected", "version": "7.5"}, {"status": "affected", "version": "7.6"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The issue can be fixed by applying a PTF to IBM i. IBM i 7.6, 7.5, 7.4, and 7.3 are addressed.\nThe IBM i PTF number for 5770-SS1 Option 34 contains the fix for the vulnerability.\n \nIBM i Release 5770-SS1\n7.6 SJ06558 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06558 \n7.5\u00a0SJ06557 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06557 \n7.4\u00a0SJ06552 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06552 \n7.3 SJ06550 https://www.ibm.com/support/fixcentral \n\nImportant note: IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products.", "supportingMedia": [{"type": "text/html", "value": "The issue can be fixed by applying a PTF to IBM i. IBM i 7.6, 7.5, 7.4, and 7.3 are addressed.<br>The IBM i PTF number for 5770-SS1 Option 34 contains the fix for the vulnerability.<br> <br>IBM i Release 5770-SS1<br>7.6 SJ06558 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06558\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06558</a><br>7.5 SJ06557 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06557\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06557</a><br>7.4 SJ06552 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06552\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06552</a><br>7.3 SJ06550 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06550\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ06550<br></a><br><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/fixcentral\">https://www.ibm.com/support/fixcentral</a><br><br>Important note: IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products.<br>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7241008", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web session hijacking vulnerability. An authenticated user without administrator privileges could exploit this vulnerability to perform actions in DCM as an administrator.", "supportingMedia": [{"type": "text/html", "value": "IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web session hijacking vulnerability. An authenticated user without administrator privileges could exploit this vulnerability to perform actions in DCM as an administrator.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-08-08T14:25:40.141Z"}}}, "cveMetadata": {"cveId": "CVE-2025-36119", "state": "PUBLISHED", "dateUpdated": "2025-08-08T14:44:09.609Z", "dateReserved": "2025-04-15T21:16:17.124Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2025-08-08T14:25:40.141Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}