Vulnerability-Lookup

VAR-202507-2600

Vulnerability from variot - Updated: 2025-08-06 23:03

IBM Sterling File Gateway

6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4

could disclose sensitive installation directory information to an authenticated user that could be used in further attacks against the system. Attackers can exploit this vulnerability to obtain sensitive path information of the system and then plan further attacks against the system

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202507-2600",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "sterling file gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "ibm",
        "version": "6.0.0.0"
      },
      {
        "model": "sterling file gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "ibm",
        "version": "6.1.2.7_1"
      },
      {
        "model": "sterling file gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "ibm",
        "version": "6.2.0.5"
      },
      {
        "model": "sterling file gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "ibm",
        "version": "6.2.0.0"
      },
      {
        "model": "sterling file gateway",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "ibm",
        "version": null
      },
      {
        "model": "sterling file gateway",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "ibm",
        "version": "6.0.0.0  that\u0027s all  6.1.2.7 1"
      },
      {
        "model": "sterling file gateway",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "ibm",
        "version": "6.2.0.0  that\u0027s all  6.2.0.5"
      },
      {
        "model": "sterling file gateway",
        "scope": "gte",
        "trust": 0.6,
        "vendor": "ibm",
        "version": "6.0.0.0,\u003c=6.1.2.6"
      },
      {
        "model": "sterling file gateway",
        "scope": "gte",
        "trust": 0.6,
        "vendor": "ibm",
        "version": "6.2.0.0,\u003c=6.2.0.4"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-16976"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-010572"
      },
      {
        "db": "NVD",
        "id": "CVE-2025-2827"
      }
    ]
  },
  "cve": "CVE-2025-2827",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "id": "CNVD-2025-16976",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "psirt@us.ibm.com",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "id": "CVE-2025-2827",
            "impactScore": 1.4,
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "OTHER",
            "availabilityImpact": "None",
            "baseScore": 4.3,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "JVNDB-2025-010572",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "psirt@us.ibm.com",
            "id": "CVE-2025-2827",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "OTHER",
            "id": "JVNDB-2025-010572",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2025-16976",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-16976"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-010572"
      },
      {
        "db": "NVD",
        "id": "CVE-2025-2827"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "IBM Sterling File Gateway \n\n6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4\n\n\n\n\n\ncould disclose sensitive installation directory information to an authenticated user that could be used in further attacks against the system. Attackers can exploit this vulnerability to obtain sensitive path information of the system and then plan further attacks against the system",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2025-2827"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-010572"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2025-16976"
      }
    ],
    "trust": 2.16
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2025-2827",
        "trust": 3.2
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-010572",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2025-16976",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-16976"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-010572"
      },
      {
        "db": "NVD",
        "id": "CVE-2025-2827"
      }
    ]
  },
  "id": "VAR-202507-2600",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-16976"
      }
    ],
    "trust": 0.06
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-16976"
      }
    ]
  },
  "last_update_date": "2025-08-06T23:03:38.358000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "7239094",
        "trust": 0.8,
        "url": "https://www.ibm.com/support/pages/node/7239094"
      },
      {
        "title": "Patch for IBM Sterling File Gateway Information Disclosure Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/709206"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-16976"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-010572"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-548",
        "trust": 1.0
      },
      {
        "problemtype": "Information disclosure through directory listings (CWE-548) [ others ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-010572"
      },
      {
        "db": "NVD",
        "id": "CVE-2025-2827"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.6,
        "url": "https://www.ibm.com/support/pages/node/7239094"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2025-2827"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-16976"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-010572"
      },
      {
        "db": "NVD",
        "id": "CVE-2025-2827"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-16976"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-010572"
      },
      {
        "db": "NVD",
        "id": "CVE-2025-2827"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2025-07-15T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2025-16976"
      },
      {
        "date": "2025-08-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2025-010572"
      },
      {
        "date": "2025-07-08T15:15:27.190000",
        "db": "NVD",
        "id": "CVE-2025-2827"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2025-07-28T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2025-16976"
      },
      {
        "date": "2025-08-05T00:48:00",
        "db": "JVNDB",
        "id": "JVNDB-2025-010572"
      },
      {
        "date": "2025-08-02T01:22:49.957000",
        "db": "NVD",
        "id": "CVE-2025-2827"
      }
    ]
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "IBM\u00a0 of \u00a0IBM\u00a0Sterling\u00a0File\u00a0Gateway\u00a0 Directory listing information disclosure vulnerability in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-010572"
      }
    ],
    "trust": 0.8
  }
}

CVE-2025-2827 (GCVE-0-2025-2827)

Vulnerability from cvelistv5 – Published: 2025-07-08 15:01 – Updated: 2025-08-24 11:22

Title

IBM Sterling File Gateway information disclosure

Summary

IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 could disclose sensitive installation directory information to an authenticated user that could be used in further attacks against the system.

Severity ?

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-548 - Exposure of Information Through Directory Listing

Assigner

ibm

References

URL

Tags

https://www.ibm.com/support/pages/node/7239094

vendor-advisorypatch

Impacted products

	Vendor	Product	Version
	IBM	Sterling File Gateway	Affected: 6.0.0.0 , ≤ 6.1.2.6 (semver) Affected: 6.2.0.0 , ≤ 6.2.0.4 (semver) cpe:2.3:a:ibm:sterling_file_gateway:6.0.0.0:::::::* cpe:2.3:a:ibm:sterling_file_gateway:6.1.2.6:::::::* cpe:2.3:a:ibm:sterling_file_gateway:6.2.0.0:::::::* cpe:2.3:a:ibm:sterling_file_gateway:6.2.0.4:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-2827",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-08T20:43:11.022036Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-08T20:43:18.839Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:sterling_file_gateway:6.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:sterling_file_gateway:6.1.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:sterling_file_gateway:6.2.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:sterling_file_gateway:6.2.0.4:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Sterling File Gateway",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "6.1.2.6",
              "status": "affected",
              "version": "6.0.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.0.4",
              "status": "affected",
              "version": "6.2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM Sterling File Gateway \n\n6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4\n\n\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ecould disclose sensitive installation directory information to an authenticated user that could be used in further attacks against the system.\u003c/span\u003e\n\n\u003c/span\u003e"
            }
          ],
          "value": "IBM Sterling File Gateway \n\n6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4\n\n\n\n\n\ncould disclose sensitive installation directory information to an authenticated user that could be used in further attacks against the system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-548",
              "description": "CWE-548 Exposure of Information Through Directory Listing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-24T11:22:04.961Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7239094"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM Sterling File Gateway  6.0.0.0 - 6.1.2.6  IT47924  Apply B2Bi 6.1.2.7_1. 6.2.0.5 or 6.2.1.0\u003cbr\u003eIBM Sterling File Gateway  6.2.0.0 - 6.2.0.4  IT47924  Apply B2Bi 6.2.0.5 or 6.2.1.0\u003cbr\u003e"
            }
          ],
          "value": "IBM Sterling File Gateway  6.0.0.0 - 6.1.2.6  IT47924  Apply B2Bi 6.1.2.7_1. 6.2.0.5 or 6.2.1.0\nIBM Sterling File Gateway  6.2.0.0 - 6.2.0.4  IT47924  Apply B2Bi 6.2.0.5 or 6.2.1.0"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Sterling File Gateway information disclosure",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2025-2827",
    "datePublished": "2025-07-08T15:01:52.545Z",
    "dateReserved": "2025-03-26T16:16:44.836Z",
    "dateUpdated": "2025-08-24T11:22:04.961Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-202507-2600

CVE-2025-2827 (GCVE-0-2025-2827)

Tags

Sightings

Nomenclature