CVE-2018-1663

CWE-200 — Information Exposure3 documents3 sources
Severity
5.9MEDIUM
EPSS
0.3%
top 51.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Datapower GatewayIBM Datapower Gateways
Timeline
PublishedDec 7
Latest updateMay 13

Description

IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6, and 2018.4 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 144889.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5ibm/datapower_gateways5 versions+4
▶NVDibm/datapower_gateway7.5.0.0 — 7.5.0.17+5

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-cmph-xcf6-q7rc: IBM DataPower Gateways 7↗2022-05-13
▶
CVEList
CVE-2018-1663: IBM DataPower Gateways 7↗2018-12-07
▶
CVE-2018-1663 (MEDIUM CVSS 5.9) | IBM DataPower Gateways 7.5 | cvebase.io