CSRF in Ibm Websphere Datapower Xc10 Appliance Firmware
CVE-2014-3058
Cross-site request forgery (CSRF) vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.005 (41.2th percentile) — read the EPSS interpretation.
Affected products
- Ibm Websphere_datapower_xc10_appliance_firmware — versions 2.1.0.0, 2.5.0.0
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@us.ibm.com (vdb-entry, x_refsource_XF)
- psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
- psirt@us.ibm.com (vendor-advisory, x_refsource_AIXAPAR)