CVE-2025-36229 LOW

CVE-2025-36229: Exposure of Sensitive System Information to an Unauthorized Control Sphere in IBM Aspera Faspex

Vendor Ibm

Product Aspera Faspex 5

Weakness CWE-497

Published December 26, 2025

Last update December 26, 2025

View on NVD All CVEs

CVSS base score

3.1/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers.

Key dates

02Disclosure timeline

December 26, 2025 CVE published

December 26, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-36229 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/497.html

Related vulnerabilities

04Related CVE

CVE-2025-67717 Zitadel Discloses the Total Number of Instance Users CVE-2023-0005 PAN-OS: Exposure of Sensitive Information Vulnerability CVE-2025-39439 WordPress wpLike2Get plugin <= 1.2.9 - Sensitive Data Exposure vulnerability CVE-2023-32550 Landscape's Apache server-status is accessible by default CVE-2026-34891 WordPress IDPay Payment Gateway for Woocommerce plugin <= 2.2.5 - Sensitive Data Exposure vulnerability