CVE-2025-36274 HIGH

CVE-2025-36274: IBM Aspera HTTP Gateway information disclosure

Vendor Ibm

Product Aspera HTTP Gateway

Weakness CWE-319 · Cleartext transmission

Published September 26, 2025

Last update September 26, 2025

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user.

Key dates

02Disclosure timeline

September 26, 2025 CVE published

September 26, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-36274 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/319.html

Related vulnerabilities

CVE-2025-36274: IBM Aspera HTTP Gateway information disclosure

01Description

02Disclosure timeline

03References

04Related CVE