CVE-2025-36373
Last modified
CVE-2025-36373 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway could disclose sensitive system information from other domains to an administrative user.. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway could disclose sensitive system information from other domains to an administrative user.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Datapower Gateway | >= 10.5.0.0, < 10.5.0.21 |
| Ibm | Datapower Gateway | >= 10.6.0.0, < 10.6.0.9 |
| Ibm | Datapower Gateway | >= 10.6.1.0, < 10.6.6.0 |
References
- https://www.ibm.com/support/pages/node/7267833Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-36373?
How severe is CVE-2025-36373?
How do I fix CVE-2025-36373?
Are you affected by CVE-2025-36373?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST