CVE-2018-1669: XEE
First published: Thu Sep 20 2018(Updated: )
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 144950.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM DataPower Gateway | >=7.1.0.0<=7.1.0.23 | |
| IBM DataPower Gateway | >=7.2.0.0<=7.2.0.21 | |
| IBM DataPower Gateway | >=7.5.0.0<=7.5.0.16 | |
| IBM DataPower Gateway | >=7.5.1.0<=7.5.1.15 | |
| IBM DataPower Gateway | >=7.5.2.0<=7.5.2.15 | |
| IBM DataPower Gateway | >=7.6.0.0<=7.6.0.8 | |
| IBM DataPower Gateway | >=7.7.0.0<=7.7.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for the XML External Entity Injection (XXE) attack on IBM DataPower Gateway?
The vulnerability ID for the XML External Entity Injection (XXE) attack on IBM DataPower Gateway is CVE-2018-1669.
What is the severity of CVE-2018-1669?
The severity of CVE-2018-1669 is high with a severity value of 7.1.
Which versions of IBM DataPower Gateway are affected by CVE-2018-1669?
IBM DataPower Gateway versions 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, 7.6.0.0 - 7.6.0.8, and 7.7.0.0 - 7.7.1.2 are affected by CVE-2018-1669.
What is the description of CVE-2018-1669?
CVE-2018-1669 is a XML External Entity Injection (XXE) vulnerability in IBM DataPower Gateway, which allows remote attackers to perform XXE attacks when processing XML data.
How can I fix CVE-2018-1669?
To fix CVE-2018-1669, IBM DataPower Gateway users should apply the necessary patches or updates provided by IBM.
- collector/nvd-index
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/ibm
- canonical/ibm datapower gateway
- version/ibm datapower gateway/7.1.0.0
- version/ibm datapower gateway/7.1.0.23
- version/ibm datapower gateway/7.2.0.0
- version/ibm datapower gateway/7.2.0.21
- version/ibm datapower gateway/7.5.0.0
- version/ibm datapower gateway/7.5.0.16
- version/ibm datapower gateway/7.5.1.0
- version/ibm datapower gateway/7.5.1.15
- version/ibm datapower gateway/7.5.2.0
- version/ibm datapower gateway/7.5.2.15
- version/ibm datapower gateway/7.6.0.0
- version/ibm datapower gateway/7.6.0.8
- version/ibm datapower gateway/7.7.0.0
- version/ibm datapower gateway/7.7.1.2