CVE-2025-36274

HIGH

IBM Aspera HTTP Gateway 2.0.0-2.3.1 - Unauthenticated Cleartext Transmission of Sensitive Information

Title source: llm
STIX 2.1

Description

IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user.

References (1)

Core 1
Core References
Patch, Vendor Advisory vendor-advisory patch
https://www.ibm.com/support/pages/node/7246284

Scores

CVSS v3 7.5
EPSS 0.0019
EPSS Percentile 8.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-319
Status published
Products (1)
ibm/aspera_http_gateway 2.0.0 - 2.3.2
Published Sep 26, 2025
Tracked Since Feb 18, 2026