« Volver al listado

CVE-2025-36374

Estado: Pendiente de análisisMedia (5.5)—

IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

IBM — Datapower GatewayAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-36374",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-36374",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-30T18:43:07.590891Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.6:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "DataPower Gateway 10.6CD",
          "versions": [
            {
              "status": "affected",
              "version": "10.6.1",
              "versionType": "semver",
              "lessThanOrEqual": "10.6.6"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.21:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "DataPower Gateway 10.5.0",
          "versions": [
            {
              "status": "affected",
              "version": "10.5.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.5.0.21"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.9:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "DataPower Gateway 10.6.0",
          "versions": [
            {
              "status": "affected",
              "version": "10.6.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.6.0.9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-07-30T19:16:58.867",
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7278748",
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources."
    },
    {
      "lang": "es",
      "value": "IBM DataPower Gateway es vulnerable a un ataque de inyección de entidad externa XML (XXE) al procesar datos XML. Un usuario privilegiado podría explotar esta vulnerabilidad para exponer información sensible o consumir recursos de memoria."
    }
  ],
  "lastModified": "2026-09-29T19:10:00.160",
  "sourceIdentifier": "psirt@us.ibm.com"
}