CVE-2025-36069: TS4500 Tape Library Insufficient Session Expiration
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.
Other sources
IBM Storage TS4500 Library does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Storage TS4500 Libraryto a version that resolves this vulnerability.Fixed in 1.12.0.4
Event History
Frequently Asked Questions
Which deployments are affected?
IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 are affected.
What does an attacker need to exploit this issue?
The attacker must already be authenticated to the system. Exploitation also requires user interaction, as reflected by the UI:R vector.
What is the impact of successful exploitation?
An authenticated user may impersonate another user because a session is not invalidated after logout. This can affect confidentiality, integrity, and availability at low impact levels.