Unscored severity · published Nov 8, 2015
CVE-2015-7412
The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require…
–
CVSS
1%
EPSS
No
On KEV
Description
The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext data, which makes it easier for remote attackers to obtain plaintext data via a padding-oracle attack.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DG
Datapower Gateway · Ibm
through 7.2.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7412
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7412
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IT10701
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21964170
More from Datapower Gateway
9.8
CVE-2026-14269
IBM DataPower Gateway Buffer Overflow
9.8
CVE-2026-14502
IBM DataPower Gateway Improper Authentication
9.8
CVE-2026-14888
IBM DataPower Gateway Buffer Overflow
9.8
CVE-2026-14988
IBM DataPower Gateway Out-of-bounds Read
9.8
CVE-2026-14992
IBM DataPower Gateway Out-of-bounds Write