CVE-2025-36225

IBM Aspera 5.0.0 through 5.0.13.1 could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of returned data.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7247502	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:ibm:aspera_faspex:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

08 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) IBM Aspera 5.0.0 hasta 5.0.13.1 podría divulgar información sensible del usuario del sistema a un usuario autenticado debido a una discrepancia observable de datos devueltos.

Information

Published : 2025-10-09 14:15

Updated : 2026-10-08 13:10

NVD link : CVE-2025-36225

Mitre link : CVE-2025-36225

CVE.ORG link : CVE-2025-36225

JSON object : View

Products Affected

linux

linux_kernel

microsoft

windows

ibm

aspera_faspex

CWE

CWE-203

Observable Discrepancy

{"id": "CVE-2025-36225", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36225", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-09T14:43:19.829682Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:aspera_faspex:5.0.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:aspera_faspex:5.0.13.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Aspera Faspex", "versions": [{"status": "affected", "version": "5.0.0", "versionType": "semver", "lessThanOrEqual": "5.0.13.1"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-09T14:15:54.913", "references": [{"url": "https://www.ibm.com/support/pages/node/7247502", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "IBM Aspera 5.0.0 through 5.0.13.1 \n\ncould disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of returned data."}, {"lang": "es", "value": "IBM Aspera 5.0.0 hasta 5.0.13.1 podr\u00eda divulgar informaci\u00f3n sensible del usuario del sistema a un usuario autenticado debido a una discrepancia observable de datos devueltos."}], "lastModified": "2026-10-08T13:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:aspera_faspex:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95A6A47B-FEAB-4581-9EA7-487A3260AF42", "versionEndExcluding": "5.0.14", "versionStartIncluding": "5.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}