PT-2019-17143 · Ibm · Ibm Datapower Gateway

Published 2019-12-09 · Updated 2019-12-17 · CVE-2019-4621

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 6.0.0 through 6.0.14 IBM DataPower Gateway versions 7.6.0.0 through 7.6.0 (no end version specified, assuming up to but not including the next major release) IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.5

Description The issue concerns a default administrator account that is enabled when the IPMI LAN channel is enabled, allowing a remote attacker to gain unauthorized access to the BMC.

Recommendations For IBM DataPower Gateway versions 6.0.0 through 6.0.14, disable the default administrator account or restrict access to the IPMI LAN channel. For IBM DataPower Gateway versions 7.6.0.0, disable the default administrator account or restrict access to the IPMI LAN channel. For IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.5, disable the default administrator account or restrict access to the IPMI LAN channel.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2019-4621

Affected Products

Ibm Datapower Gateway

References · 4

• https://osv.dev/vulnerability/CVE-2019-4621 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/168883 · Vendor Advisory
• https://ibm.com/support/pages/node/1125615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-4621 · Security Note