Skip to content
Sign in
5.5 Medium

CVE-2022-31775 IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21…

Description

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228359.

Affected products and versions

Product Affected versions Fixed in
DataPower Gateway 2018.4 2018.4.1.0 → 2018.4.1.20 No fix stated
DataPower Gateway 10.5.0.0 No fix stated
DataPower Gateway 10.1.0.7 No fix stated
DataPower Gateway 10.0 10.0.1.0 → 10.0.4.0 No fix stated

Other CVEs of DataPower Gateway

The 26 CVEs of DataPower Gateway →
CVE-2022-40228 IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0… 3.7 Low CVE-2022-31773 IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an… 8.8 High CVE-2022-32750 IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21… 5.4 Medium CVE-2022-31776 IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21… 6.5 Medium
Track this CVE