CVE-2025-36033: IBM Engineering Lifecycle Management - Global Configuration Management is vulnerable to cross-site scripting

Published Jan 27, 2026
·
Updated

IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 through 7.1.0 Interim Fix 004 IBM Global Configuration Management is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Software

25 affected components
IBM Engineering Lifecycle Management - Global Configuration Management<=7.0.3 to 7.0.3 iFix017
IBM Engineering Lifecycle Management - Global Configuration Management<=7.1.0 to 7.1.0 iFix004
IBM Engineering Lifecycle Management=7.0.3
IBM Engineering Lifecycle Management=7.0.3-ifix002
IBM Engineering Lifecycle Management=7.0.3-ifix003
IBM Engineering Lifecycle Management=7.0.3-ifix004
IBM Engineering Lifecycle Management=7.0.3-ifix005
IBM Engineering Lifecycle Management=7.0.3-ifix006
IBM Engineering Lifecycle Management=7.0.3-ifix007
IBM Engineering Lifecycle Management=7.0.3-ifix008
IBM Engineering Lifecycle Management=7.0.3-ifix009
IBM Engineering Lifecycle Management=7.0.3-ifix010
IBM Engineering Lifecycle Management=7.0.3-ifix011
IBM Engineering Lifecycle Management=7.0.3-ifix012
IBM Engineering Lifecycle Management=7.0.3-ifix013
IBM Engineering Lifecycle Management=7.0.3-ifix014
IBM Engineering Lifecycle Management=7.0.3-ifix015
IBM Engineering Lifecycle Management=7.0.3-ifix016
IBM Engineering Lifecycle Management=7.0.3-ifix017
IBM Engineering Lifecycle Management=7.1.0
IBM Engineering Lifecycle Management=7.1.0-ifix001
IBM Engineering Lifecycle Management=7.1.0-ifix0010
IBM Engineering Lifecycle Management=7.1.0-ifix002
IBM Engineering Lifecycle Management=7.1.0-ifix003
IBM Engineering Lifecycle Management=7.1.0-ifix004

Remediation

Information

IBM strongly recommends addressing the vulnerability now by upgrading to iFixes detailed below: IBM recommends customers on ELM 7.0.1, 7.0.2 or any version below 7.0.3 to upgrade your products to Maintenance release 7.0.3 and apply below fix. Optionally, upgrade to the latest 7.2.0 version. Affected Product(s)Version(s)Remediation/Fix/InstructionsIBM Engineering Lifecycle Management - Jazz Foundation 7.0.3Download and install iFix018 https://www.ibm.com/support/fixcentral/swg/downloadFixes  or laterIBM Engineering Lifecycle Management - Jazz Foundation 7.1.0Download and install iFix005 https://www.ibm.com/support/fixcentral/swg/downloadFixes  or later

Event History

Jan 27, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Feb 3, 2026
CVE Published
via MITRE·10:12 PM
Data Sourced
via MITRE·10:12 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-36033?

CVE-2025-36033 has a severity rating that indicates a medium risk due to its potential for cross-site scripting vulnerabilities.

2

How do I fix CVE-2025-36033?

To mitigate CVE-2025-36033, users should upgrade to the latest versions of IBM Engineering Lifecycle Management that address this vulnerability.

3

What versions are affected by CVE-2025-36033?

CVE-2025-36033 affects IBM Engineering Lifecycle Management - Global Configuration Management versions from 7.0.3 to 7.0.3 Interim Fix 017 and 7.1.0 to 7.1.0 Interim Fix 004.

4

Is CVE-2025-36033 an internal or external risk?

CVE-2025-36033 represents an external risk as it involves cross-site scripting which can be exploited by malicious users through the web application.

5

What are the potential impacts of CVE-2025-36033?

The impacts of CVE-2025-36033 may include unauthorized access to sensitive data and the ability for attackers to execute scripts in users' browsers.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203