Vulnerability Details : CVE-2021-38910
IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By sending a specially crafted JSON message, an attacker could exploit this vulnerability to modify structure and fields. IBM X-Force ID: 209824.
Vulnerability category: Input validation
Products affected by CVE-2021-38910
- cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*
- IBM » Datapower GatewayVersions from including (>=) 2018.4.1.0 and up to, including, (<=) 2018.4.1.18cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:datapower_gateway:10.0.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:datapower_gateway:10.0.3.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-38910
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 40 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-38910
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST | |
3.7
|
LOW | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
2.2
|
1.4
|
IBM Corporation | |
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2021-38910
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-38910
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/209824
IBM DataPower Gateway security bypass CVE-2021-38910 Vulnerability ReportVDB Entry;Vendor Advisory
-
https://www.ibm.com/support/pages/node/6562347
Security Bulletin: IBM DataPower Gateway permits reflected JSON injection (CVE-2021-38910)Vendor Advisory
Jump to