CVE-2012-5756

IBM WebSphere DataPower XC10 Appliance 2.0.0.0-2.0.0.3 and 2.1.0.0-2.1.0.2 - Remote Spoofing via Shared Secret Key

Title source: llm
STIX 2.1

Description

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2, when a collective configuration is enabled, has a single secret key that is shared across different customers' installations, which allows remote attackers to spoof a container server by (1) sniffing the network to locate a cleartext transmission of this key or (2) leveraging knowledge of this key from another installation.

References (7)

Core 7
Core References
Various Sources x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg24033740
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1PM68926
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/56617
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/79921
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1027798
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/51319
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21615783

Scores

EPSS 0.0135
EPSS Percentile 68.5%

Details

CWE
CWE-310
Status published
Products (7)
ibm/websphere_datapower_xc10_appliance 2.0.0.0
ibm/websphere_datapower_xc10_appliance 2.0.0.1
ibm/websphere_datapower_xc10_appliance 2.0.0.2
ibm/websphere_datapower_xc10_appliance 2.0.0.3
ibm/websphere_datapower_xc10_appliance 2.1.0.0
ibm/websphere_datapower_xc10_appliance 2.1.0.1
ibm/websphere_datapower_xc10_appliance 2.1.0.2
Published Nov 23, 2012
Tracked Since Feb 18, 2026