CVE-2025-36002CWE-256CWE-260

CVE-2025-36002

Medium · published October 16, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
3.8
In the wild
Unconfirmed
What it is

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5, and 6.2.1.0 stores user credentials in configuration files which can be read by a local user.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00150 · 3.8th percentile
Weaknesses
CWE-256 · Plaintext Storage of a Password; CWE-260 · Password in Configuration File
Published
2025-10-16T19:15Z
Affected products (4)
ProductVersionsFixed in
ibm/sterling_b2b_integrator≥ 6.2.0.0, < 6.2.0.5_16.2.0.5_1
ibm/sterling_b2b_integratorall versions—
ibm/sterling_file_gateway≥ 6.2.0.0, < 6.2.0.5_16.2.0.5_1
ibm/sterling_file_gatewayall versions—
References (1)
https://www.ibm.com/support/pages/node/7248129 · [email protected]
EPSS history
Timeline
  • 16 OCT 14:54Z
    IBM Sterling B2B Integrator information disclosure
    cvelistv5