BaseFortify

Publication date: 2025-10-16

Last updated on: 2025-10-25

Assigner: IBM Corporation

Description

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5, and 6.2.1.0 stores user credentials in configuration files which can be read by a local user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-16

Last Modified

2025-10-25

Generated

2026-07-06

AI Q&A

2025-10-16

EPSS Evaluated

2026-07-05

NVD

CVE-2025-36002

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.15.160 (inc) to 5.16 (inc)
ibm	sterling_b2b_integrator	From 6.2.0.0 (inc) to 6.2.0.5_1 (exc)
ibm	sterling_b2b_integrator	6.2.1.0
ibm	sterling_file_gateway	From 6.2.0.0 (inc) to 6.2.0.5_1 (exc)
ibm	sterling_file_gateway	6.2.1.0
ibm	aix	*
microsoft	windows	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-260	The product stores a password in a configuration file that might be accessible to actors who do not know the password.
CWE-256	The product stores a password in plaintext within resources such as memory or files.

Attack-Flow Graph

Executive Summary

This vulnerability involves IBM Sterling B2B Integrator and IBM Sterling File Gateway versions specified, where user credentials are stored in configuration files that can be read by a local user. This means that someone with local access to the system can potentially access sensitive credential information stored insecurely.

Impact Analysis

The impact of this vulnerability is that a local user could read stored user credentials from configuration files, potentially leading to unauthorized access to systems or data. This could compromise confidentiality but does not directly affect integrity or availability.

Hi! I’m here to help you understand CVE-2025-36002. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70