CVE-2022-31773

2022-08-2618:15:08

CWE-352

[email protected]

web.nvd.nist.gov

ibm datapower gateway

cross-site request forgery

security vulnerability

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

29.5%

JSON

IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 228357.

Affected configurations

Nvd

Node

ibmdatapower_gatewayRange10.0.1.0–10.5.0-

ibmdatapower_gatewayRange10.0.2.0–10.5.0continuous_delivery

ibmdatapower_gatewayRange2018.4.1.0–2018.4.1.21-

VendorProductVersionCPE
ibmdatapower_gateway*cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:-:*:*:*
ibmdatapower_gateway*cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:continuous_delivery:*:*:*

Vendor	Product	Version	CPE
ibm	datapower_gateway	*	cpe:2.3:a:ibm:datapower_gateway:::::-:::*
ibm	datapower_gateway	*	cpe:2.3:a:ibm:datapower_gateway:::::continuous_delivery:::*