Security Bulletin: IBM DataPower Gateway vulnerable to CSRF attack

Summary

IBM DataPower Gateway is vulnerable to a cross-site request forgery attack against the Web UI. IBM has addressed the vulnerability.

Vulnerability Details

CVEID:CVE-2022-31773
**DESCRIPTION:**IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Base score: 8.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/228357 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

The fix is also available in version 10.5.0; customers using earlier releases may upgrade free of charge to 10.5.0.

Workarounds and Mitigations

Customers should ensure that management interfaces are accessible only via internal networks. Administrators should not click on links from untrusted sources, and should log out when not actually performing administrative tasks.