Information disclosure in IBM Datapower Gateway

CVE-2015-7412

The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext data, which makes it easier for remote attackers to obtain plaintext data via a padding-oracle attack.

Vulnerability class: Information Disclosure

EPSS: 0.010 (59.7th percentile) — read the EPSS interpretation.

Affected products

Ibm Datapower_gateway
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
psirt@us.ibm.com (vendor-advisory, Vendor Advisory, x_refsource_AIXAPAR)