CVE-2021-38910: Input Validation
First published: Wed Mar 09 2022(Updated: )
IBM DataPower Gateway could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By sending a specially crafted JSON message, an attacker could exploit this vulnerability to modify structure and fields.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM DataPower Gateway | >=10.0.1.0<=10.0.1.5 | |
| IBM DataPower Gateway | >=2018.4.1.0<=2018.4.1.18 | |
| IBM DataPower Gateway | =10.0.2.0 | |
| IBM DataPower Gateway | =10.0.3.0 | |
| <=10.0.2.0, 10.0.3.0 | ||
| <=10.0.1.0-10.0.1.5 | ||
| <=2018.4.1.0-2108.4.1.18 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this IBM DataPower Gateway vulnerability?
The vulnerability ID of this IBM DataPower Gateway vulnerability is CVE-2021-38910.
What is the severity of CVE-2021-38910?
The severity of CVE-2021-38910 is medium with a severity value of 5.3.
How can a remote attacker exploit CVE-2021-38910?
A remote attacker can exploit CVE-2021-38910 by sending a specially crafted JSON message to bypass security restrictions and modify structure and fields.
Which versions of IBM DataPower Gateway are affected by CVE-2021-38910?
IBM DataPower Gateway versions 10.0.1 and 2108.4.1, as well as IBM DataPower Gateway V10CD versions 10.0.2.0 and 10.0.3.0 are affected by CVE-2021-38910.
Is there a fix available for CVE-2021-38910?
Yes, IBM has released a fix for CVE-2021-38910. Please refer to the IBM Support page for more information.
- collector/nvd-index
- agent/references
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/author
- agent/weakness
- agent/description
- agent/softwarecombine
- agent/event
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/tags
- agent/trending
- vendor/ibm
- canonical/ibm datapower gateway
- version/ibm datapower gateway/10.0.1.0
- version/ibm datapower gateway/10.0.1.5
- version/ibm datapower gateway/2018.4.1.0
- version/ibm datapower gateway/2018.4.1.18
- version/ibm datapower gateway/10.0.2.0
- version/ibm datapower gateway/10.0.3.0
- canonical/ibm datapower gateway v10cd
- version/ibm datapower gateway v10cd/10.0.2.0, 10.0.3.0
- canonical/ibm datapower gateway 10.0.1
- version/ibm datapower gateway 10.0.1/10.0.1.0-10.0.1.5
- canonical/ibm datapower gateway 2108.4.1
- version/ibm datapower gateway 2108.4.1/2018.4.1.0-2108.4.1.18