VulnerabilityModified
CVE-2015-1893
The IBM WebSphere DataPower XC10 appliance 2.1 before 2.1.0.3 allows remote attackers to hijack the sessions of arbitrary users, and consequently obtain sensitive information or modify data, via unspecified vectors.
MEDIUM 6.8EPSS 1.69%
Does this matter?
Lower severity and a low EPSS score (1.69%). Track it; it rarely justifies an emergency change on its own.
Description
The IBM WebSphere DataPower XC10 appliance 2.1 before 2.1.0.3 allows remote attackers to hijack the sessions of arbitrary users, and consequently obtain sensitive information or modify data, via unspecified vectors.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.69% probability · 76th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- ibm/websphere datapower xc10 appliance firmware
- Source
- psirt@us.ibm.com
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT07841Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21701337Patch, Vendor Advisory
- http://www.securityfocus.com/bid/73916Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032025Third Party Advisory, VDB Entry
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT07841Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21701337Patch, Vendor Advisory
- http://www.securityfocus.com/bid/73916Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032025Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.