PT-2022-10801 · Ibm · Ibm Datapower Gateway

Marek Jílek · Published 2022-03-10 · Updated 2022-03-18 · CVE-2021-38910

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.0.1 through 2108.4.1 IBM DataPower Gateway V10CD

Description The issue is caused by the improper validation of input, allowing a remote attacker to bypass security restrictions. By sending a specially crafted JSON message, an attacker could exploit this to modify structure and fields.

Recommendations For IBM DataPower Gateway versions 10.0.1 through 2108.4.1, update to a version that properly validates input to prevent bypassing of security restrictions. For IBM DataPower Gateway V10CD, ensure proper validation of input is in place to mitigate the risk of exploitation. As a temporary workaround, consider restricting the ability to send specially crafted JSON messages to the gateway until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-38910

Affected Products

Ibm Datapower Gateway

References · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/209824 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38910 · Vendor Advisory
• https://ibm.com/support/pages/node/6562347 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38910 · Security Note
• https://t.me/cibsecurity/38743 · Telegram Post