Vulnerability-Lookup

FKIE_CVE-2025-15395

Vulnerability from fkie_nvd - Published: 2026-02-02 16:16 - Updated: 2026-02-11 20:34

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Summary

IBM Jazz Foundation 7.0.3 through 7.0.3 iFix019 and 7.1.0 through 7.1.0 iFix005 is vulnerable to access control violations that allows the users to view or access/perform actions beyond their expected capability.

References

	URL	Tags
	psirt@us.ibm.com	https://www.ibm.com/support/pages/node/7258304	Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.0.3
ibm	jazz_foundation	7.1.0
ibm	jazz_foundation	7.1.0
ibm	jazz_foundation	7.1.0
ibm	jazz_foundation	7.1.0
ibm	jazz_foundation	7.1.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:-:*:*:*:*:*:*",
              "matchCriteriaId": "E7BEB914-06D8-4F0B-89C8-DFFF89B432F4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix001:*:*:*:*:*:*",
              "matchCriteriaId": "FF01D2AF-8FCB-49FB-BD5F-17877F7731F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix002:*:*:*:*:*:*",
              "matchCriteriaId": "B766EDB8-4115-4682-B1AD-57C99107A195",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix003:*:*:*:*:*:*",
              "matchCriteriaId": "9AB07BE6-C24B-4D7A-B906-2268BAF742CB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix004:*:*:*:*:*:*",
              "matchCriteriaId": "C405EE5A-4320-4960-B430-00AFCF540089",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix005:*:*:*:*:*:*",
              "matchCriteriaId": "CE6616C0-F434-4189-AF6E-07AB0E04626F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix006:*:*:*:*:*:*",
              "matchCriteriaId": "854B0828-F782-4F8E-9970-AA7BF2A4F0F5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix007:*:*:*:*:*:*",
              "matchCriteriaId": "76F5529B-09C3-4B3D-B670-978EDE39F086",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix008:*:*:*:*:*:*",
              "matchCriteriaId": "E2FD2D5C-2BF9-4558-B794-A2CEC3E13E3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix009:*:*:*:*:*:*",
              "matchCriteriaId": "71F966A3-4D5A-4870-91A0-F7BE6AEECDFE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix010:*:*:*:*:*:*",
              "matchCriteriaId": "32BB09AF-ED78-4FFB-8313-AC527250CE6C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix011:*:*:*:*:*:*",
              "matchCriteriaId": "01E9BCE0-684F-4624-BD4C-2A90E160C63D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix012:*:*:*:*:*:*",
              "matchCriteriaId": "62031B5D-C2BE-433B-89D4-9CEB013E0402",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix013:*:*:*:*:*:*",
              "matchCriteriaId": "86F6DF11-AC1B-4B9C-89B0-C5930775AC95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix014:*:*:*:*:*:*",
              "matchCriteriaId": "4AA16E96-2467-4542-991A-C38906494A7F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix015:*:*:*:*:*:*",
              "matchCriteriaId": "9F7B38A2-AB25-4FFB-BC2F-6D29BCD57C65",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix016:*:*:*:*:*:*",
              "matchCriteriaId": "C6249D2A-8564-415F-BF39-887C6B1D3679",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix017:*:*:*:*:*:*",
              "matchCriteriaId": "1CA1754B-4021-486A-8700-C725098EF3D3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix018:*:*:*:*:*:*",
              "matchCriteriaId": "1DAB4860-8F6E-4066-A56F-67CBE40185EF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.1.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "53EA48FB-EA3A-4111-AAAF-F7053DBEEEA3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.1.0:ifix001:*:*:*:*:*:*",
              "matchCriteriaId": "5BD93D68-30C9-4E29-8295-AC0121F2EFF3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.1.0:ifix002:*:*:*:*:*:*",
              "matchCriteriaId": "979A3BCA-1EDD-4020-918B-BBEBB6F7EFF0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.1.0:ifix003:*:*:*:*:*:*",
              "matchCriteriaId": "A32F602D-AE6E-4120-9E24-BD18989FB80C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:jazz_foundation:7.1.0:ifix004:*:*:*:*:*:*",
              "matchCriteriaId": "5D3BC640-5946-4349-8E62-6C2D4AF03ADC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Jazz Foundation\u00a07.0.3 through\u00a07.0.3 iFix019 and\u00a07.1.0 through\u00a07.1.0 iFix005\u00a0is vulnerable to access control violations that allows the users to view or access/perform actions beyond their expected capability."
    },
    {
      "lang": "es",
      "value": "IBM Jazz Foundation 7.0.3 hasta 7.0.3 iFix019 y 7.1.0 hasta 7.1.0 iFix005 es vulnerable a violaciones de control de acceso que permite a los usuarios ver o acceder/realizar acciones m\u00e1s all\u00e1 de su capacidad esperada."
    }
  ],
  "id": "CVE-2025-15395",
  "lastModified": "2026-02-11T20:34:53.650",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-02-02T16:16:18.187",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7258304"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "psirt@us.ibm.com",
      "type": "Primary"
    }
  ]
}

CVE-2025-15395 (GCVE-0-2025-15395)

Vulnerability from cvelistv5 – Published: 2026-02-02 15:10 – Updated: 2026-02-02 16:45

Title

IBM Jazz Foundation access control violation

Summary

Severity ?

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-863 - Incorrect Authorization

Assigner

ibm

References

URL

Tags

https://www.ibm.com/support/pages/node/7258304

vendor-advisorypatch

Impacted products

	Vendor	Product	Version
	IBM	Jazz Foundation	Affected: 7.0.3 , ≤ 7.0.3 iFix019 (semver) Affected: 7.1.0 , ≤ 7.1.0 iFix005 (semver) cpe:2.3:a:ibm:jazz_foundation:7.0.3:::::::* cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix019:::::: cpe:2.3:a:ibm:jazz_foundation:7.1.0:::::::* cpe:2.3:a:ibm:jazz_foundation:7.1.0:ifix005::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-15395",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-02T16:44:58.231516Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-02T16:45:31.338Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:jazz_foundation:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:jazz_foundation:7.0.3:ifix019:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:jazz_foundation:7.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:jazz_foundation:7.1.0:ifix005:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Jazz Foundation",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "7.0.3 iFix019",
              "status": "affected",
              "version": "7.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.0 iFix005",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM Jazz Foundation\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e7.0.3 through\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e7.0.3 iFix019 and\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e7.1.0 through\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e7.1.0 iFix005\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eis vulnerable to access control violations that allows the users to view or access/perform actions beyond their expected capability.\u003c/span\u003e\u003cbr\u003e\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "IBM Jazz Foundation\u00a07.0.3 through\u00a07.0.3 iFix019 and\u00a07.1.0 through\u00a07.1.0 iFix005\u00a0is vulnerable to access control violations that allows the users to view or access/perform actions beyond their expected capability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-02T15:10:56.983Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7258304"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM recommends customers on ELM 7.0.1, 7.0.2 or any version below 7.0.3 to upgrade your products to Maintenance release 7.0.3 and apply below fix.\u003c/p\u003e\u003cp\u003eOptionally, upgrade to the latest 7.2.0 version.\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eAffected Product(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fix/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eIBM Engineering Lifecycle Management - Jazz Foundation\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e7.0.3\u003c/td\u003e\u003ctd\u003eDownload and install \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Engineering\u0026amp;product=ibm/Rational/IBM+Engineering+Lifecycle+Management\u0026amp;release=7.0.3\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=7.0.3-IBM-ELM-iFix020\u0026amp;includeRequisites=0\u0026amp;includeSupersedes=0\u0026amp;downloadMethod=http\"\u003eiFix020\u003c/a\u003e\u0026nbsp;or later\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eIBM Engineering Lifecycle Management - Jazz Foundation\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e7.1.0\u003c/td\u003e\u003ctd\u003eDownload and install \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Engineering\u0026amp;product=ibm/Rational/IBM+Engineering+Lifecycle+Management\u0026amp;release=7.1\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=7.1-IBM-ELM-iFix006\u0026amp;includeRequisites=0\u0026amp;includeSupersedes=0\u0026amp;downloadMethod=http\"\u003eiFix006\u003c/a\u003e\u0026nbsp;or later\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "IBM recommends customers on ELM 7.0.1, 7.0.2 or any version below 7.0.3 to upgrade your products to Maintenance release 7.0.3 and apply below fix.\n\nOptionally, upgrade to the latest 7.2.0 version.\n\nAffected Product(s)Version(s)Remediation/Fix/InstructionsIBM Engineering Lifecycle Management - Jazz Foundation\n\n7.0.3Download and install  iFix020 https://www.ibm.com/support/fixcentral/swg/downloadFixes \u00a0or laterIBM Engineering Lifecycle Management - Jazz Foundation\n\n7.1.0Download and install  iFix006 https://www.ibm.com/support/fixcentral/swg/downloadFixes \u00a0or later"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Jazz Foundation access control violation",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2025-15395",
    "datePublished": "2026-02-02T15:10:56.983Z",
    "dateReserved": "2025-12-31T14:28:58.770Z",
    "dateUpdated": "2026-02-02T16:45:31.338Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2025-15395

CVE-2025-15395 (GCVE-0-2025-15395)

Tags

Sightings

Nomenclature