IBM Datacap versions 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious website, a remote attacker could exploit this vulnerability to hijack the victim’s click actions and possibly launch further attacks against the victim.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-36027 |
Exploitation
To exploit this vulnerability, an attacker must convince a victim to visit a malicious website. Once the victim is on the site, the attacker can hijack the victim’s click actions, potentially leading to unauthorized actions or further attacks.
Affected Products
- IBM Datacap 9.1.7: A version of IBM’s document capture software that is vulnerable to click hijacking.
- IBM Datacap 9.1.8: An updated version that still retains the vulnerability allowing for remote exploitation.
- IBM Datacap 9.1.9: The latest version in the series that is also affected by this security issue.
Mitigation
To mitigate this vulnerability, users should avoid clicking on untrusted links and ensure that their software is updated to the latest version. Additionally, implementing security measures such as web filtering and user education can help reduce the risk of exploitation.