Medium severity · published Jul 12, 2025
CVE-2025-36104
IBM Storage Scale information disclosure
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
IBM Storage Scale 5.2.3.0 and 5.2.3.1 could allow an authenticated user to obtain sensitive information from files due to the insecure permissions inherited through the SMB protocol.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Storage Scale · IBM
5.2.3.0, 5.2.3.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-36104
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-36104
Vendor Advisory
https://www.ibm.com/support/pages/node/7239562
More from Storage Scale
8.8
CVE-2025-1137
IBM Storage Scale command injection
8.4
CVE-2022-41739
IBM Spectrum Scale (IBM Spectrum Scale Container Native Storage Access 5.1.2.1 through 5.1.6.0) could allow programs running inside the container to overcome isolation mechanism…
7.8
CVE-2022-43831
IBM Storage Scale Container Native Storage Access 5.1.2.1 through 5.1.6.1 could allow a local user to obtain escalated privileges on a host without proper security context…
7.8
CVE-2022-41736
IBM Spectrum Scale Container Native Storage Access 5.1.2.1 through 5.1.6.0 contains an unspecified vulnerability that could allow a local user to obtain root privileges
7.8
CVE-2022-43867
IBM Spectrum Scale 5.1.0.1 through 5.1.4.1 could allow a local attacker to execute arbitrary commands in the container