cnvd - cnvd-2025-10422

cnvd-2025-10422

Vulnerability from cnvd

Title: IBM Jazz Reporting Service代码问题漏洞

Description:

IBM Jazz Reporting Service是美国国际商业机器（IBM）公司的一套即用型报告组件。该产品包括报表生成、数据收集和生命周期查询等功能。

IBM Jazz Reporting Service存在代码问题漏洞，该漏洞源于注销后会话未失效，攻击者可利用该漏洞导致特权用户冒充其他用户。

Severity: 中

Patch Name: IBM Jazz Reporting Service代码问题漏洞的补丁

Patch Description:

IBM Jazz Reporting Service是美国国际商业机器（IBM）公司的一套即用型报告组件。该产品包括报表生成、数据收集和生命周期查询等功能。

IBM Jazz Reporting Service存在代码问题漏洞，该漏洞源于注销后会话未失效，攻击者可利用该漏洞导致特权用户冒充其他用户。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级程序修复该安全问题，详情见厂商官网： https://www.ibm.com/support/pages/node/7229760

Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-25051

Impacted products

Name
['IBM Jazz Reporting Service 7.0.2', 'IBM Jazz Reporting Service 7.0.3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-25051",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-25051"
    }
  },
  "description": "IBM Jazz Reporting Service\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u5957\u5373\u7528\u578b\u62a5\u544a\u7ec4\u4ef6\u3002\u8be5\u4ea7\u54c1\u5305\u62ec\u62a5\u8868\u751f\u6210\u3001\u6570\u636e\u6536\u96c6\u548c\u751f\u547d\u5468\u671f\u67e5\u8be2\u7b49\u529f\u80fd\u3002\n\nIBM Jazz Reporting Service\u5b58\u5728\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u6ce8\u9500\u540e\u4f1a\u8bdd\u672a\u5931\u6548\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7279\u6743\u7528\u6237\u5192\u5145\u5176\u4ed6\u7528\u6237\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51\uff1a\r\nhttps://www.ibm.com/support/pages/node/7229760",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-10422",
  "openTime": "2025-05-19",
  "patchDescription": "IBM Jazz Reporting Service\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u5957\u5373\u7528\u578b\u62a5\u544a\u7ec4\u4ef6\u3002\u8be5\u4ea7\u54c1\u5305\u62ec\u62a5\u8868\u751f\u6210\u3001\u6570\u636e\u6536\u96c6\u548c\u751f\u547d\u5468\u671f\u67e5\u8be2\u7b49\u529f\u80fd\u3002\r\n\r\nIBM Jazz Reporting Service\u5b58\u5728\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u6ce8\u9500\u540e\u4f1a\u8bdd\u672a\u5931\u6548\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7279\u6743\u7528\u6237\u5192\u5145\u5176\u4ed6\u7528\u6237\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Jazz Reporting Service\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM Jazz Reporting Service 7.0.2",
      "IBM Jazz Reporting Service 7.0.3"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-25051",
  "serverity": "\u4e2d",
  "submitTime": "2025-05-12",
  "title": "IBM Jazz Reporting Service\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2024-25051 (GCVE-0-2024-25051)

Vulnerability from cvelistv5

Published

2025-04-02 14:57

Modified

2025-09-01 10:14

Severity ?

6.6 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-613 - Insufficient Session Expiration

Summary

IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another user on the system.

References

▼	URL	Tags
	https://www.ibm.com/support/pages/node/7229760	vendor-advisory, patch

Impacted products

	Vendor	Product	Version
	IBM	Jazz Reporting Service	Version: 7.0.2 Version: 7.0.3 cpe:2.3:a:ibm:jazz_reporting_service:7.0.2:::::::* cpe:2.3:a:ibm:jazz_reporting_service:7.0.3:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-25051",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-02T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-03T03:55:28.941Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:jazz_reporting_service:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:jazz_reporting_service:7.0.3:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Jazz Reporting Service",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.2"
            },
            {
              "status": "affected",
              "version": "7.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another user on the system."
            }
          ],
          "value": "IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another user on the system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-01T10:14:53.515Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7229760"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Jazz Reporting Service insufficient session expiration",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2024-25051",
    "datePublished": "2025-04-02T14:57:12.391Z",
    "dateReserved": "2024-02-03T14:49:33.094Z",
    "dateUpdated": "2025-09-01T10:14:53.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted