← CVE Intelligence

CVE-2025-36374

IBM DataPower Gateway affected by XML external entity injection PUBLISHED

Description (CNA)

IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.

Affected (CNA)

Vendor / productVersions
IBM / DataPower Gateway 10.6CDaffected 10.6.1 through 10.6.6
IBM / DataPower Gateway 10.5.0affected 10.5.0.0 through 10.5.0.21
IBM / DataPower Gateway 10.6.0affected 10.6.0.0 through 10.6.0.9

CWE

CWE-611

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.