CVE-2014-3058

IBM WebSphere DataPower XC10 Appliance 2.1 and 2.5 - Authenticated Cross-Site Request Forgery

Title source: llm
STIX 2.1

Description

Cross-site request forgery (CSRF) vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/93532
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21691035
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IT04614

Scores

EPSS 0.0052
EPSS Percentile 40.5%

Details

CWE
CWE-352
Status published
Products (2)
ibm/websphere_datapower_xc10_appliance_firmware 2.1.0.0
ibm/websphere_datapower_xc10_appliance_firmware 2.5.0.0
Published Dec 11, 2014
Tracked Since Feb 18, 2026