6.8

CVE-2025-36373

Incorrect administrative access control in IBM DataPower Gateway

IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway could disclose sensitive system information from other domains to an administrative user.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Datapower Gateway Version >= 10.5.0.0 < 10.5.0.21
Ibm ≫ Datapower Gateway Version >= 10.6.0.0 < 10.6.0.9
Ibm ≫ Datapower Gateway SwEditioncontinuous_delivery Version >= 10.6.1.0 < 10.6.6.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.04% 0.107
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 2.3 4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
psirt@us.ibm.com 4.1 2.3 1.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.