CVE-2025-36373: datapower gateway from 10.5.0.0 (inclusive), before 10.5.0.21 (exclusive), from 10.6.0.0 (inclusive), before 10.6.0.9…

Affected technology

datapower gateway · from 10.5.0.0 (inclusive), before 10.5.0.21 (exclusive)
ibm

datapower gateway · from 10.6.0.0 (inclusive), before 10.6.0.9 (exclusive)
ibm

datapower gateway · from 10.6.1.0 (inclusive), before 10.6.6.0 (exclusive)
ibm

DataPower Gateway 10.6CD · 10.6.1.0 through 10.6.5.0
IBM

DataPower Gateway 10.5.0 · 10.5.0.0 through 10.5.0.20
IBM

DataPower Gateway 10.6.0 · 10.6.0.0 through 10.6.0.8
IBM

Description’s affected range: through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway could disclose sensitive system information from other domains to an administrative user

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 4.1/10) rates confidentiality impact as low; integrity and availability impact as none. NVD’s CVSS 3.1 assessment (base score 6.8/10) rates confidentiality impact as high; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.