CVE-2018-1669

HIGH

7.1

CVSS Score

Published: September 25, 2018 at 04:00 PM UTC

Updated: June 17, 2026 at 01:51 AM UTC

1 product affected across 1 vendorDataPower Gateway

Using DataPower Gateways by IBM?

Get instant alerts when new vulnerabilities affect DataPower Gateways - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.1

Exploit prediction

EPSS 2%

Description

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 144950.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

DataPower Gateway · IBM

95%

7.1.0.0 ≤ v ≤ 7.1.0.237.2.0.0 ≤ v ≤ 7.2.0.217.5.0.0 ≤ v ≤ 7.5.0.167.5.1.0 ≤ v ≤ 7.5.1.157.5.2.0 ≤ v ≤ 7.5.2.157.6.0.0 ≤ v ≤ 7.6.0.87.7.0.0 ≤ v ≤ 7.7.1.27.1.0.0 7.1.0.23 7.2.0.0 7.2.0.21 7.5.0.0 7.5.0.16 7.5.1.0 7.5.1.15 7.5.2.0 7.5.2.15 7.6.0.0 7.6.0.8 7.7.0.0 7.7.1.2