Unscored severity · published Oct 2, 2014
CVE-2014-3060
Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale…
–
CVSS
2.4%
EPSS
No
On KEV
Description
Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WD
Websphere Datapower Xc10 Appliance · Ibm
All versions, or not specified · source: NVD
WD
Websphere Datapower Xc10 Appliance Firmware · Ibm
2.5.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3060
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3060
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IT03476
Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21685705
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/93534
More from Websphere Datapower Xc10 Appliance
–
CVE-2014-3059
Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging…
–
CVE-2013-5446
The console on IBM WebSphere DataPower XC10 appliances 2.1.0 and 2.5.0 does not properly process logoff actions, which has unspecified impact and remote attack vectors
–
CVE-2013-5428
IBM WebSphere DataPower XC10 appliances 2.5.0 do not require authentication for all administrative actions, which allows remote attackers to cause a denial of service via…
–
CVE-2013-0499
Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote…
–
CVE-2013-0600
Unspecified vulnerability on IBM WebSphere DataPower XC10 Appliance devices 2.0 and 2.1 through 2.1 FP3 allows remote attackers to bypass authentication and perform administrative…