CVE-2025-36002
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5, and 6.2.1.0 stores user credentials in configuration files which can be read by a local user.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.5
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.14%
- CWE
- CWE-260
- Published
- 2025-10-16
- Last modified
- 2026-03-13
Affected products
- IBM Sterling B2B Integrator
- IBM Sterling B2B Integrator
- IBM Sterling File Gateway
- IBM Sterling File Gateway
Weakness type
Related vulnerabilities
- CVE-2019-25465 — Hisilicon HiIpcam V100R003 Information Disclosure via Directory Traversal
- CVE-2025-15151 — TaleLin Lin-CMS Tests Folder config.py password in configuration file
- CVE-2023-53770 — MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint
- CVE-2023-53739 — Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure
- CVE-2025-33119 — IBM QRadar SIEM Information Disclosure
- CVE-2025-36100 — IBM MQ information disclosure
- CVE-2025-57754 — eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)
- CVE-2025-6513 — BRAIN2 Configuration file for database access not sufficiently secured