var-202208-0089
Vulnerability from variot
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228359. Vendor exploits this vulnerability IBM X-Force ID: 228359 It is published as.Information is obtained and service operation is interrupted (DoS) It may be in a state. IBM DataPower Gateway is a security and integration platform specially designed for mobile, cloud, application programming interface (API), network, service-oriented architecture (SOA), B2B and cloud workloads. The platform secures, integrates . The vulnerability stems from the fact that the network system or product does not set the correct filter to allow reference to external entities. Remote attackers can use this vulnerability to read files by sending specially crafted XML files
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202208-0089",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "datapower gateway",
"scope": "eq",
"trust": 1.8,
"vendor": "ibm",
"version": "10.5.0.0"
},
{
"model": "datapower gateway",
"scope": "lt",
"trust": 1.0,
"vendor": "ibm",
"version": "10.0.1.8"
},
{
"model": "datapower gateway",
"scope": "lt",
"trust": 1.0,
"vendor": "ibm",
"version": "2018.4.1.21"
},
{
"model": "datapower gateway",
"scope": "gte",
"trust": 1.0,
"vendor": "ibm",
"version": "2018.4.1.0"
},
{
"model": "datapower gateway",
"scope": "gte",
"trust": 1.0,
"vendor": "ibm",
"version": "10.0.2.0"
},
{
"model": "datapower gateway",
"scope": "lt",
"trust": 1.0,
"vendor": "ibm",
"version": "10.5.0.1"
},
{
"model": "datapower gateway",
"scope": "gte",
"trust": 1.0,
"vendor": "ibm",
"version": "10.0.1.0"
},
{
"model": "datapower gateway",
"scope": "eq",
"trust": 0.8,
"vendor": "ibm",
"version": "2018.4.1.0 to 2018.4.1.21"
},
{
"model": "datapower gateway",
"scope": "eq",
"trust": 0.8,
"vendor": "ibm",
"version": "10.0.2.0 to 10.0.4.0"
},
{
"model": "datapower gateway",
"scope": "eq",
"trust": 0.8,
"vendor": "ibm",
"version": "10.0.1.0 to 10.0.1.8"
},
{
"model": "datapower gateway",
"scope": "eq",
"trust": 0.8,
"vendor": "ibm",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-016038"
},
{
"db": "NVD",
"id": "CVE-2022-31775"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:ibm:datapower_gateway:10.5.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.0.1.8",
"versionStartIncluding": "10.0.1.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:continuous_delivery:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.5.0.1",
"versionStartIncluding": "10.0.2.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2018.4.1.21",
"versionStartIncluding": "2018.4.1.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2022-31775"
}
]
},
"cve": "CVE-2022-31775",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "psirt@us.ibm.com",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 1.2,
"impactScore": 4.2,
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.1,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2022-31775",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2022-31775",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "psirt@us.ibm.com",
"id": "CVE-2022-31775",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202208-1841",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-016038"
},
{
"db": "NVD",
"id": "CVE-2022-31775"
},
{
"db": "NVD",
"id": "CVE-2022-31775"
},
{
"db": "CNNVD",
"id": "CNNVD-202208-1841"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228359. Vendor exploits this vulnerability IBM X-Force ID: 228359 It is published as.Information is obtained and service operation is interrupted (DoS) It may be in a state. IBM DataPower Gateway is a security and integration platform specially designed for mobile, cloud, application programming interface (API), network, service-oriented architecture (SOA), B2B and cloud workloads. The platform secures, integrates . The vulnerability stems from the fact that the network system or product does not set the correct filter to allow reference to external entities. Remote attackers can use this vulnerability to read files by sending specially crafted XML files",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-31775"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-016038"
},
{
"db": "VULHUB",
"id": "VHN-423625"
},
{
"db": "VULMON",
"id": "CVE-2022-31775"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-31775",
"trust": 3.4
},
{
"db": "JVNDB",
"id": "JVNDB-2022-016038",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202208-1841",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2022-56970",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-423625",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2022-31775",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-423625"
},
{
"db": "VULMON",
"id": "CVE-2022-31775"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-016038"
},
{
"db": "NVD",
"id": "CVE-2022-31775"
},
{
"db": "CNNVD",
"id": "CNNVD-202208-1841"
}
]
},
"id": "VAR-202208-0089",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-423625"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T13:00:40.460000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "6608608 IBM\u00a0X-Force\u00a0Exchange",
"trust": 0.8,
"url": "https://www.ibm.com/support/pages/node/6608608"
},
{
"title": "IBM DataPower Gateway Fixes for code issue vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=202581"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-016038"
},
{
"db": "CNNVD",
"id": "CNNVD-202208-1841"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-611",
"trust": 1.1
},
{
"problemtype": "XML Improper restriction of external entity references (CWE-611) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-423625"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-016038"
},
{
"db": "NVD",
"id": "CVE-2022-31775"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "https://www.ibm.com/support/pages/node/6608608"
},
{
"trust": 1.8,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/228359"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-31775"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/ibm-datapower-gateway-external-xml-entity-injection-via-web-ui-39376"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-31775/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-423625"
},
{
"db": "VULMON",
"id": "CVE-2022-31775"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-016038"
},
{
"db": "NVD",
"id": "CVE-2022-31775"
},
{
"db": "CNNVD",
"id": "CNNVD-202208-1841"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-423625"
},
{
"db": "VULMON",
"id": "CVE-2022-31775"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-016038"
},
{
"db": "NVD",
"id": "CVE-2022-31775"
},
{
"db": "CNNVD",
"id": "CNNVD-202208-1841"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-08-01T00:00:00",
"db": "VULHUB",
"id": "VHN-423625"
},
{
"date": "2022-08-01T00:00:00",
"db": "VULMON",
"id": "CVE-2022-31775"
},
{
"date": "2023-10-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-016038"
},
{
"date": "2022-08-01T11:15:13.737000",
"db": "NVD",
"id": "CVE-2022-31775"
},
{
"date": "2022-08-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202208-1841"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-08-04T00:00:00",
"db": "VULHUB",
"id": "VHN-423625"
},
{
"date": "2022-08-01T00:00:00",
"db": "VULMON",
"id": "CVE-2022-31775"
},
{
"date": "2023-10-02T01:11:00",
"db": "JVNDB",
"id": "JVNDB-2022-016038"
},
{
"date": "2022-08-04T18:34:18.353000",
"db": "NVD",
"id": "CVE-2022-31775"
},
{
"date": "2022-09-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202208-1841"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202208-1841"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "IBM\u00a0DataPower\u00a0Gateway\u00a0 In \u00a0XML\u00a0 External entity vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-016038"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "code problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202208-1841"
}
],
"trust": 0.6
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.