PT-2015-5523 · Ibm · Ibm Websphere Datapower Xc10 Appliance

Published 2015-08-03 · Updated 2015-08-04 · CVE-2015-1970

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliance versions 2.1 through 2.1.0.3 IBM WebSphere DataPower XC10 appliance versions 2.5 through 2.5.0.4

Description The issue allows physically proximate attackers to obtain sensitive information by extracting an SSD card and attaching it elsewhere, due to the appliance retaining data on the cards.

Recommendations For versions 2.1 through 2.1.0.3, ensure proper physical security of the SSD cards to prevent unauthorized access. For versions 2.5 through 2.5.0.4, consider implementing data encryption on the SSD cards to protect sensitive information in case of physical theft.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-1970

Affected Products

Ibm Websphere Datapower Xc10 Appliance

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-1970 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21962861 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT09803 · Vendor Advisory