CVE-2025-36375
Last modified
CVE-2025-36375 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Datapower Gateway | >= 10.5.0.0, < 10.5.0.21 |
| Ibm | Datapower Gateway | >= 10.6.0.0, < 10.6.0.9 |
| Ibm | Datapower Gateway | >= 10.6.1.0, < 10.6.6.0 |
References
- https://www.ibm.com/support/pages/node/7268034Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-36375?
How severe is CVE-2025-36375?
How do I fix CVE-2025-36375?
Are you affected by CVE-2025-36375?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST