CVE-2025-36363
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
IBM DevOps Plan 3.0.0 through 3.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
Risk Assessment
An attacker could gain unauthorized access to user accounts via brute force, potentially leading to data confidentiality and integrity breaches.
Recommendation
Configure proper account lockout policies (e.g., login attempt limits) or upgrade to a newer version of IBM DevOps Plan if available.
Other vulnerabilities in IBM DevOps Plan
See all- CVE-2026-4096Medium
IBM DevOps Plan versions 3.0.0 through 3.0.6 is vulnerable to HTTP header injection due to improper validation of input in the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning, or session hijacking.
- CVE-2025-36364Medium
IBM DevOps Plan 3.0.0 through 3.0.5 stores web page cache locally, allowing another system user to read it.
Original NVD description (English source)
IBM DevOps Plan 3.0.0 through 3.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS