VulnerabilityModified

CVE-2020-5008

This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.

MEDIUM 5.3EPSS 0.87%

Does this matter?

Lower severity and a low EPSS score (0.87%). Track it; it rarely justifies an emergency change on its own.

Description

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 193033.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.87% probability · 57th percentile
CISA KEV: Not listed
Weakness: CWE-922
Affected: ibm/datapower gateway
Source: psirt@us.ibm.com

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/193033VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6459681Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/193033VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6459681Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.