CVE-2025-36274CWE-319

CVE-2025-36274

High · published September 26, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
10.2
In the wild
Unconfirmed
What it is

IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00207 · 10.2th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2025-09-26T19:16Z
Affected products (1)
ProductVersionsFixed in
ibm/aspera_http_gateway≥ 2.0.0, < 2.3.22.3.2
References (1)
https://www.ibm.com/support/pages/node/7246284 · [email protected]
EPSS history
Timeline
  • 26 SEP 14:14Z
    IBM Aspera HTTP Gateway information disclosure
    cvelistv5