IBM Jazz Foundation CVE-2025-1826

Exploitation requires (1) a valid authenticated account on the DOORS Next / Jazz Foundation application with at least low-privilege write access to Web UI fields that store and later render user-supplied content, (2) network reachability to the host (described by IBM as 'authenticated users on the host network'), and (3) a second victim user who subsequently views the attacker-injected content (UI:R), whose session is then used for credential disclosure. Limiting factors: this is not remotely exploitable by unauthenticated attackers - credentials are mandatory (PR:L) and the payload only triggers when another user renders it, so successful impact depends on social-engineering or normal workflow viewing by a higher-value target. Affected versions are IBM Jazz Foundation 7.0.2 through 7.0.2 iFix034, 7.0.3 through 7.0.3 iFix016, and 7.1.0 through 7.1.0 iFix004.

This is a medium-severity stored cross-site scripting flaw (CVSS 5.4) in IBM Engineering Requirements Management DOORS Next / Jazz Foundation, and the signals are consistent in pointing to a non-urgent, second-tier priority rather than an active emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows network reachability but requires an authenticated low-privilege account AND victim user interaction, with only low confidentiality/integrity impact and no availability impact; the scope change (S:C) reflects script executing in another user's trusted browser session. The EPSS score of 0.18% (7th percentile) is low and aligns with the absence of a CISA KEV listing and no identified public exploit code, so there is no evidence of exploitation pressure. No signals conflict here - low EPSS, no KEV, and no POC all reinforce each other. The main caveat is that the IBM description says 'authenticated users on the host network,' which combined with PR:L and UI:R means an attacker must already have valid credentials and must lure a legitimate user into viewing the poisoned content; this is a realistic insider or post-compromise escalation vector rather than a mass-exploitable remote bug. Net: treat as a routine patch-management item, prioritized below internet-facing unauthenticated flaws.

An authenticated low-privilege user with access to the DOORS Next Web UI injects malicious JavaScript into a requirements artifact or editable field that is stored and later rendered to other users. When a higher-privileged user (e.g., an administrator or project lead) views the poisoned content, the script executes in their trusted session, potentially exfiltrating session credentials or performing actions as that user. No public exploit code has been identified at time of analysis.