CVE-2025-36033

MEDIUMMonitor

Published:Feb 3, 2026(3 months ago)

Modified:Feb 25, 2026

Remote ExploitScope ChangesLow Complexity

Vulnerability Description

IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 through 7.1.0 Interim Fix 004 IBM Global Configuration Management is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Attack Characteristics

Network AccessLow ComplexityLow PrivilegesUser Interaction Required

🤖

AI analysis not yet available

Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.

No Fix Known

No patch has been released yet. Apply workarounds or mitigations where available.

Affected Software

Vendor	Product	Versions	Fixed In
ibm	engineering_lifecycle_management	-	-
ibm	engineering_lifecycle_management	-	-
ibm	engineering_lifecycle_management

Timeline

Published
CVE disclosed publicly
Feb 3, 20263 months ago
Last Modified
Most recent update
Feb 25, 20262 months ago
Indexed to CVEInsight
Added to this platform
Mar 29, 20261 month ago

References

https://www.ibm.com/support/pages/node/7258063Vendor Advisory

CVSS Score

v3.1

5.4/ 10.0

MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

At a Glance

Affected Products

References

ibm / engineering_lifecycle_management

CVE-2025-36033

Vulnerability Description

Attack Characteristics

Affected Software

Timeline

References

CVSS Score

At a Glance

Official Sources

CVSS v3 Vector

Impact Analysis

CVE-2025-36033

✦ Vulnerability Description

Attack Characteristics

Affected Software

Timeline

References

CVSS Score

At a Glance

Official Sources

CVSS v3 Vector

Impact Analysis

Vulnerability Description