XML External Entity Injection in IBM DataPower Gateway Products
CVE-2018-1669

7.1HIGH

Key Information:

Vendor
IBM
Status
Datapower Gateways
Datapower Gateway Cd
Vendor
CVE Published:
25 September 2018

Summary

IBM DataPower Gateway products are exposed to an XML External Entity Injection (XXE) vulnerability during XML data processing. This flaw allows a remote attacker to exploit these products, potentially leading to unauthorized access to sensitive information or depletion of memory resources. Proper mitigation strategies are essential to safeguard against this type of threat, ensuring the integrity and confidentiality of data handled by these gateways.

Affected Version(s)

DataPower Gateway CD 7.7.0.0

DataPower Gateway CD 7.7.1.2

DataPower Gateways 7.1.0.0

References

https://www.ibm.com/support/docview.wss?uid=ibm10730489
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/144950
vdb-entryx_refsource_XF

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.