CVE-2018-1669: XEE
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 144950.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for the XML External Entity Injection (XXE) attack on IBM DataPower Gateway?
The vulnerability ID for the XML External Entity Injection (XXE) attack on IBM DataPower Gateway is CVE-2018-1669.
What is the severity of CVE-2018-1669?
The severity of CVE-2018-1669 is high with a severity value of 7.1.
Which versions of IBM DataPower Gateway are affected by CVE-2018-1669?
IBM DataPower Gateway versions 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, 7.6.0.0 - 7.6.0.8, and 7.7.0.0 - 7.7.1.2 are affected by CVE-2018-1669.
What is the description of CVE-2018-1669?
CVE-2018-1669 is a XML External Entity Injection (XXE) vulnerability in IBM DataPower Gateway, which allows remote attackers to perform XXE attacks when processing XML data.
How can I fix CVE-2018-1669?
To fix CVE-2018-1669, IBM DataPower Gateway users should apply the necessary patches or updates provided by IBM.