Lucene search

IBM2822697BBA2D86273C9A78E98422E86D9B62D8AD7F78EC87F198F43CD5EB8BA9

HistoryMay 26, 2022 - 4:52 p.m.

Security Bulletin: IBM DataPower vulnerable to CSRF

2022-05-2616:52:49

www.ibm.com

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

30.0%

JSON

Summary

IBM has addressed the CVE

Vulnerability Details

CVEID:CVE-2020-4938
**DESCRIPTION:**IBM MQ Appliance 9.1 and 9.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191815.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/191815 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM DataPower Gateway V10CD	10.0.2.0
IBM DataPower Gateway 10.0.1	10.0.1.0-10.0.1.3
IBM DataPower Gateway	2018.4.1.0-2018.4.1.17

Remediation/Fixes

Affected product	Fixed in version	APAR
IBM DataPower Gateway V10CD	10.0.3.0	IT40922
IBM DataPower Gateway 10.0.1	10.0.1.4	IT40922
IBM DataPower Gateway 2018.4.1	2018.4.1.18	IT40922

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmdatapower_gatewayMatch10.0.2.0

ibmdatapower_gatewayRange10.0.1.0≥

ibmdatapower_gatewayRange≤10.0.1.3

ibmdatapower_gatewayRange2018.4.1.0≥

ibmdatapower_gatewayRange≤2018.4.1.17

CPENameOperatorVersion
ibm datapower gateway v10cdeq10.0.2.0
ibm datapower gateway 10.0.1ge10.0.1.0
ibm datapower gateway 10.0.1le10.0.1.3
ibm datapower gatewayge2018.4.1.0
ibm datapower gatewayle2018.4.1.17

Name	Operator	Version
ibm datapower gateway v10cd	eq	10.0.2.0
ibm datapower gateway 10.0.1	ge	10.0.1.0
ibm datapower gateway 10.0.1	le	10.0.1.3
ibm datapower gateway	ge	2018.4.1.0
ibm datapower gateway	le	2018.4.1.17

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

30.0%

JSON

Related for 2822697BBA2D86273C9A78E98422E86D9B62D8AD7F78EC87F198F43CD5EB8BA9