CVE-2025-36364
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
IBM DevOps Plan 3.0.0 through 3.0.5 stores web page cache locally, allowing another system user to read it.
Risk Assessment
A local user can access sensitive data stored in another user's cache, leading to information disclosure.
Recommendation
Update IBM DevOps Plan to the latest patched version.
Other vulnerabilities in IBM DevOps Plan
See all- CVE-2026-4096Medium
IBM DevOps Plan versions 3.0.0 through 3.0.6 is vulnerable to HTTP header injection due to improper validation of input in the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning, or session hijacking.
- CVE-2025-36363Medium
IBM DevOps Plan 3.0.0 through 3.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
Original NVD description (English source)
IBM DevOps Plan 3.0.0 through 3.0.5 allows web page cache to be stored locally which can be read by another user on the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS