PT-2019-9364 · Ibm · Ibm Datapower Gateway

Jeremy Soh + 1 · Publicado 2019-02-07 · Atualizado 2020-08-24 · CVE-2018-1666

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 7.5.0.0 through 7.5.0.19 IBM DataPower Gateway versions 7.5.1.0 through 7.5.1.18 IBM DataPower Gateway versions 7.5.2.0 through 7.5.2.18 IBM DataPower Gateway versions 7.6.0.0 through 7.6.0.11 IBM DataPower Gateway versions 7.7.0.0 through 7.7.1.3 IBM DataPower Gateway version 2018.4.1.0

Description The issue allows an authenticated user to inject arbitrary messages that would be displayed on the UI.

Recommendations For IBM DataPower Gateway version 2018.4.1.0, update to a version that fixes this issue. For IBM DataPower Gateway versions 7.5.0.0 through 7.5.0.19, update to a version that fixes this issue. For IBM DataPower Gateway versions 7.5.1.0 through 7.5.1.18, update to a version that fixes this issue. For IBM DataPower Gateway versions 7.5.2.0 through 7.5.2.18, update to a version that fixes this issue. For IBM DataPower Gateway versions 7.6.0.0 through 7.6.0.11, update to a version that fixes this issue. For IBM DataPower Gateway versions 7.7.0.0 through 7.7.1.3, update to a version that fixes this issue.

Correção

Identificadores relacionados

CVE-2018-1666

Produtos afetados

Ibm Datapower Gateway

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-1666 · Nota de Segurança
• https://ibm.com/support/docview.wss?uid=ibm10744205 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/144892 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1666 · Aviso do Fabricante