Devops Plan
CVE-2025-36363
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
IBM DevOps Plan 3.0.0 through 3.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
AnalysisAI
Brute force credential attacks against IBM DevOps Plan 3.0.0 through 3.0.5 allow unauthenticated remote attackers to gain account credentials due to missing or inadequate account lockout protections. The vulnerability enables systematic password guessing without rate limits or lockouts, potentially exposing user accounts. No active exploitation or public proof-of-concept is known, and EPSS indicates a very low likelihood of exploitation (0.05%).
More in Devops Plan
View allHTTP header injection in IBM DevOps Plan 3.0.0 through 3.0.6 allows unauthenticated remote attackers to inject arbitrary
IBM DevOps Plan 3.0.0 through 3.0.5 allows web page cache to be stored locally which can be read by another user on the
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today