IBM Jazz Reporting Service 拒绝服务漏洞

Successful exploitation of CVE-2025-1823 allows an authenticated user to induce a denial of service within the IBM Jazz Reporting Service. The attacker can craft malicious SQL queries designed to exhaust memory resources, leading to service instability and potential outages. This can disrupt reporting functionalities and impact users relying on the service for data analysis and insights. While the CVSS score is LOW, the impact of a DoS can still be significant, particularly in environments where reporting is critical for operational decision-making. The vulnerability's reliance on authenticated access limits the potential attack surface, but internal users with sufficient privileges pose a risk.

Organizations utilizing IBM Jazz Reporting Service versions 7.0.3 through 7.1iFix006, particularly those with internal users who have authenticated access to the reporting service and the ability to execute SQL queries, are at risk. Shared hosting environments where multiple users share the same Jazz Reporting Service instance are also potentially vulnerable.

1. 2026-02-04Disclosure

   disclosure

1. 已保留2025-03-01
2. 发布日期2026-02-04
3. 修改日期2026-02-05
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-1823 is to upgrade IBM Jazz Reporting Service to version 7.1.1 or later, which contains the fix. If immediate upgrading is not feasible, consider implementing temporary workarounds. Restricting access to the reporting service to trusted users and implementing input validation on SQL queries can help reduce the risk. Monitoring memory usage on the server hosting Jazz Reporting Service is also recommended to detect potential DoS attacks. After upgrading, confirm the fix by attempting to execute the malicious SQL query and verifying that it no longer causes excessive memory consumption.