CVE-2018-1421: IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data

Description

IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 139023.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.4% · higher than 72% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

DG

Datapower Gateway · Ibm

7.1.0.0 through 7.1.0.21; 7.2.0.0 through 7.2.0.18; 7.5.0.0 through 7.5.0.13; 7.5.1.0 through 7.5.1.12; 7.5.2.0 through 7.5.2.12; 7.6.0.0 through 7.6.0.5 · source: NVD