Jazz Service Management CVE-2025-36249

Exploitation requires three concrete conditions drawn from the description: (1) the victim must have an active authenticated session with Jazz for Service Management whose session cookie / authorization token lacks the Secure attribute; (2) the victim must be induced to follow an http:// (cleartext) link to the application, either sent directly or planted on a site they visit; and (3) the attacker must be able to observe the resulting cleartext traffic (man-in-the-middle or passive network snooping on the victim's path). Limiting factors: exploitation is defeated if HTTPS is strictly enforced / HSTS is enabled so the browser never issues a cleartext request, if the attacker has no network-interception vantage point, and if the user does not follow the malicious http:// link. This is a transport-security/hardening gap, not a remote-unauthenticated server-side flaw - the 'network' vector is real but gated by user interaction and attacker network positioning.

This is a genuinely low-priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) formally scores it as medium, but the real-world signals converge on low risk: EPSS is 0.16% (4th percentile), it is NOT in CISA KEV, and no public exploit code was identified. The CVSS 'low' confidentiality-only impact (I:N/A:N) correctly reflects that this is an information-disclosure weakness (CWE-614, missing Secure flag on cookies) rather than code execution or data tampering. Importantly, the CVSS vector understates the practical difficulty: it marks AC:L/UI:N, yet the description itself describes an attack requiring the attacker to (a) lure the user to an http:// link AND (b) be positioned to snoop network traffic - i.e., both social engineering and a man-in-the-middle/network-interception capability. This conflict (CVSS AC:L/UI:N versus a description implying user interaction and privileged network positioning) should be noted: the attack is harder than AC:L/UI:N suggests. Net assessment: a legitimate hardening defect worth patching in routine cycles, not an emergency; exploitation is plausible only against targeted users on attacker-controllable network paths.

An attacker able to intercept network traffic on a path the victim uses (e.g., shared/public Wi-Fi or a compromised network segment) sends or plants an http:// link to the Jazz for Service Management instance. When the authenticated user's browser follows it, the session cookie - lacking the Secure attribute - is transmitted over cleartext HTTP, and the attacker captures it by passively snooping the traffic to hijack the session. No public exploit code was identified at time of analysis.