IBM Datacap versions 9.1.7, 9.1.8, and 9.1.9 do not set the secure attribute on authorization tokens or session cookies. This vulnerability allows attackers to potentially capture cookie values by tricking users into clicking on malicious links. Once the cookie is sent to an insecure link, attackers can snoop on the traffic to obtain sensitive information.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2025-36026 |
Exploitation
To exploit this vulnerability, an attacker can create a malicious link that, when clicked by a user, redirects them to an insecure site. This link can be sent via email or embedded in a compromised website. Once the user interacts with the link, their session cookies may be transmitted insecurely, allowing the attacker to capture them.
Affected Products
- IBM Datacap 9.1.7: A version of IBM’s document capture software that is vulnerable due to insecure cookie handling.
- IBM Datacap 9.1.8: An updated version that still retains the same vulnerability regarding session cookies.
- IBM Datacap 9.1.9: The latest version in the series that is also affected by this security issue.
Mitigation
To mitigate this vulnerability, it is recommended to ensure that the secure attribute is set on all authorization tokens and session cookies. Additionally, users should be educated about the risks of clicking on unknown links and encouraged to use secure connections (HTTPS) whenever possible.