Listen to this Post
CVE-2025-36112 is an information disclosure vulnerability affecting IBM Sterling B2B Integrator and IBM Sterling File Gateway. The flaw allows unauthorized users to access sensitive server IP configuration details. This occurs due to insufficient access controls on certain web interfaces or API endpoints. Specifically, administrative or configuration endpoints fail to properly authenticate requests. When an unauthenticated user sends HTTP requests to these endpoints, the system responds with internal IP addresses, network settings, and other critical data. The affected versions include 6.0.0.0 through 6.1.2.7, 6.2.0.0 through 6.2.0.5, and 6.2.1.1. The vulnerability likely stems from exposed debug information or missing permission checks. Attackers can exploit this by crafting simple GET or POST requests to paths like /config or /settings. Using tools such as curl or browsers, they can retrieve configuration files or error messages containing IP data. This leaked information can facilitate network reconnaissance, aiding in further attacks like lateral movement or targeted exploits. IBM has acknowledged the issue and is working on patches. The vulnerability underscores the importance of securing administrative interfaces and validating user access.
Platform: IBM Sterling B2B
Version: 6.0.0.0-6.1.2.7 6.2.0.0-6.2.0.5 6.2.1.1
Vulnerability: Information Disclosure
Severity: Medium
Date: 11/24/2025
Prediction: Patch by 12/2025
What Undercode Say:
Analytics:
curl -v http://
wget http://
grep -r “ip address” logs/
for url in $(list.txt); do curl -s $url/rest/settings; done
How Exploit:
Send unauthenticated requests to /console/config endpoints. Use curl or Burp Suite to probe for IP data in responses. Automate with scripts to harvest configuration details.
Protection from this CVE:
Apply IBM security patches. Restrict network access to admin interfaces. Enforce authentication on all endpoints.
Impact:
Internal network exposure. Aids targeted attacks. Confidentiality breach.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
