CVE-2014-3060

2014-10-0200:55:03

[email protected]

web.nvd.nist.gov

cve-2014-3060

ibm

websphere

datapower

xc10

appliance

vulnerability

remote attackers

administrative privileges

nvd

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

6.7 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.2%

JSON

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie.

Affected configurations

NVD

Node

ibmwebsphere_datapower_xc10_appliance_firmwareMatch2.5.0.0

AND

ibmwebsphere_datapower_xc10_applianceMatch-

CPENameOperatorVersion
ibm:websphere_datapower_xc10_appliance_firmwareibm websphere datapower xc10 appliance firmwareeq2.5.0.0
ibm:websphere_datapower_xc10_applianceibm websphere datapower xc10 applianceeq-

CPE	Name	Operator	Version
ibm:websphere_datapower_xc10_appliance_firmware	ibm websphere datapower xc10 appliance firmware	eq	2.5.0.0
ibm:websphere_datapower_xc10_appliance	ibm websphere datapower xc10 appliance	eq	-