Home

Description

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

PUBLISHED Reserved 2025-04-15 | Published 2025-06-28 | Updated 2025-08-24 | Assigner ibm




MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Problem types

CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Product status

Default status
unaffected

9.1.7
affected

9.1.8
affected

9.1.9
affected

References

www.ibm.com/support/pages/node/7238443 vendor-advisory patch

cve.org (CVE-2025-36026)

nvd.nist.gov (CVE-2025-36026)

Download JSON