Unscored severity · published Oct 22, 2013
CVE-2013-5446
The console on IBM WebSphere DataPower XC10 appliances 2.1.0 and 2.5.0 does not properly process logoff actions, which has unspecified impact and remote attack vectors
–
CVSS
1.7%
EPSS
No
On KEV
Description
The console on IBM WebSphere DataPower XC10 appliances 2.1.0 and 2.5.0 does not properly process logoff actions, which has unspecified impact and remote attack vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WD
Websphere Datapower Xc10 Appliance · Ibm
All versions, or not specified · source: NVD
WD
Websphere Datapower Xc10 Appliance Firmware · Ibm
2.1.0.0; 2.5.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-5446
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-5446
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1IC93164
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1IC96617
Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg21653546
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/87910
More from Websphere Datapower Xc10 Appliance
–
CVE-2014-3060
Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale…
–
CVE-2014-3059
Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging…
–
CVE-2013-5428
IBM WebSphere DataPower XC10 appliances 2.5.0 do not require authentication for all administrative actions, which allows remote attackers to cause a denial of service via…
–
CVE-2013-0499
Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote…
–
CVE-2013-0600
Unspecified vulnerability on IBM WebSphere DataPower XC10 Appliance devices 2.0 and 2.1 through 2.1 FP3 allows remote attackers to bypass authentication and perform administrative…