XSS in IBM Jazz Foundation
CVE-2025-1826
IBM Engineering Requirements Management DOORS Next (IBM Jazz Foundation 7.0.2 to 7.0.2 iFix034, 7.0.3 to 7.0.3 iFix016, and 7.1.0 to 7.1.0 iFix004) is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users on the host network to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (6.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Ibm Jazz Foundation — versions 7.0.2, 7.0.3, 7.1.0
- Ibm Jazz_foundation — versions 7.0.2, 7.0.3, 7.1.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@us.ibm.com (vendor-advisory, Patch, patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-1826?
- CVE-2025-1826 is a medium-severity vulnerability in IBM Jazz Foundation, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2025-10-07.
- How severe is CVE-2025-1826?
- Medium severity. CVSS v3 base score is 5.4 out of 10.
- Is CVE-2025-1826 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.