CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
IBM DataPower Gateway uses the micromatch module in its UI.
CVEID:CVE-2024-4067
**DESCRIPTION:**Node.js micromatch module is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in micromatch.braces() in index.js. By sending a specially crafted payload, a remote attacker could exploit this vulnerability to increase the consumption time until the application hangs or slows down.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/290676 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Product(s) | Version(s) |
---|---|
IBM DataPower Gateway 10.5.0 | 10.5.0.0 - 10.5.0.12 |
IBM DataPower Gateway 10.6.0 | 10.6.0.0 |
Affected Products | Fixed in version | APAR |
---|---|---|
IBM DataPower Gateway 10.5.0 | 10.5.0.13 | IT46692 |
IBM DataPower Gateway 10.6.0 | 10.6.0.1 | IT46692 |
IBM strongly recommends addressing the vulnerability now
None
Vendor | Product | Version | CPE |
---|---|---|---|
ibm | datapower_gateway | 10.5.0 | cpe:2.3:a:ibm:datapower_gateway:10.5.0:*:*:*:*:*:*:* |
ibm | datapower_gateway | 10.6.0 | cpe:2.3:a:ibm:datapower_gateway:10.6.0:*:*:*:*:*:*:* |