CVE-2025-36397

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-36397", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:16:59.139Z", "datePublished": "2026-01-20T15:23:30.652Z", "dateUpdated": "2026-01-20T15:47:24.284Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:application_gateway:23.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:application_gateway:23.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:application_gateway:25.09:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:application_gateway:25.09.0:*:*:*:*:*:*:*"], "product": "Application Gateway", "vendor": "IBM", "versions": [{"lessThanOrEqual": "25.09", "status": "affected", "version": "23.10", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.</p>"}], "value": "IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-80", "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-01-20T15:23:30.652Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7256857"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><strong>IBM encourages all customers to update their systems promptly.</strong></p><p><strong>IBM Application Gateway (Container):</strong></p><p>Obtain the latest version of the container by running this command (without quotation marks):<br>&nbsp; &nbsp; \u201cdocker pull icr.io/ibmappgateway/ibm-application-gateway:[tag]\u201d &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</p><p>Where [tag] is the latest published version and can be confirmed <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.verify.ibm.com/gateway/docs/containers\">here</a>.</p><br>"}], "value": "IBM encourages all customers to update their systems promptly.\n\nIBM Application Gateway (Container):\n\nObtain the latest version of the container by running this command (without quotation marks):\n\u00a0 \u00a0 \u201cdocker pull icr.io/ibmappgateway/ibm-application-gateway:[tag]\u201d \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\n\nWhere [tag] is the latest published version and can be confirmed here https://docs.verify.ibm.com/gateway/docs/containers ."}], "title": "Security vulnerabilities have been found in IBM Application Gateway", "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T15:47:02.680173Z", "id": "CVE-2025-36397", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:47:24.284Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36397", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T15:47:02.680173Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:47:15.219Z"}}], "cna": {"title": "Security vulnerabilities have been found in IBM Application Gateway", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:application_gateway:23.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:application_gateway:23.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:application_gateway:25.09:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:application_gateway:25.09.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Application Gateway", "versions": [{"status": "affected", "version": "23.10", "versionType": "semver", "lessThanOrEqual": "25.09"}]}], "solutions": [{"lang": "en", "value": "IBM encourages all customers to update their systems promptly.\n\nIBM Application Gateway (Container):\n\nObtain the latest version of the container by running this command (without quotation marks):\n\u00a0 \u00a0 \u201cdocker pull icr.io/ibmappgateway/ibm-application-gateway:[tag]\u201d \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\n\nWhere [tag] is the latest published version and can be confirmed here https://docs.verify.ibm.com/gateway/docs/containers .", "supportingMedia": [{"type": "text/html", "value": "<p><strong>IBM encourages all customers to update their systems promptly.</strong></p><p><strong>IBM Application Gateway (Container):</strong></p><p>Obtain the latest version of the container by running this command (without quotation marks):<br>&nbsp; &nbsp; \u201cdocker pull icr.io/ibmappgateway/ibm-application-gateway:[tag]\u201d &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</p><p>Where [tag] is the latest published version and can be confirmed <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.verify.ibm.com/gateway/docs/containers\">here</a>.</p><br>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7256857", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-01-20T15:23:30.652Z"}}}, "cveMetadata": {"cveId": "CVE-2025-36397", "state": "PUBLISHED", "dateUpdated": "2026-01-20T15:47:24.284Z", "dateReserved": "2025-04-15T21:16:59.139Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-01-20T15:23:30.652Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:application_gateway:23.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:application_gateway:23.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:application_gateway:25.09:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:application_gateway:25.09.0:*:*:*:*:*:*:*"], "product": "Application Gateway", "vendor": "IBM", "versions": [{"lessThanOrEqual": "25.09", "status": "affected", "version": "23.10", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:application_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "24D8BDA9-CB77-41CA-95ED-ABBEA4F88CAA", "versionEndIncluding": "25.09", "versionStartIncluding": "23.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site."}, {"lang": "es", "value": "IBM Application Gateway 23.10 hasta 25.09 es vulnerable a la inyecci\u00f3n HTML. Un atacante remoto podr\u00eda inyectar c\u00f3digo HTML malicioso que, al ser visualizado, se ejecutar\u00eda en el navegador web de la v\u00edctima dentro del contexto de seguridad del sitio anfitri\u00f3n."}], "id": "CVE-2025-36397", "lastModified": "2026-06-17T09:14:42.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36397", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T15:47:02.680173Z", "version": "2.0.3"}}]}, "published": "2026-01-20T16:16:04.030", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7256857"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-80"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{}