IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6, and 2018.4 could allow a remote attacker to obtain sensitive information, caused by the fail…

Published 7 y ago 2018-12-07 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.9

v3.0 · CNA

CISA KEV

not known exploited

EPSS

2.3%

percentile 83%

Public exploits

none known

IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6, and 2018.4 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 144889.

Exploit prediction (EPSS)

2.28% probability of exploitation in the next 30 days, higher than 83% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	5.9	`CVSS:3.0/A:N/AC:H/AV:N/C:H/I:N/PR:N/S:U/UI:N/E:U/RC:C/RL:O`
CNA	3.0	5.9	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	3.0	5.9	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:P/I:N/A:N`

Affected products

IBM DataPower Gateways

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

exchange.xforce.ibmcloud.com /vulnerabilities/144889 · vdb-entry, x_refsource_XF, x_transferred
securityfocus.com /bid/106199 · vdb-entry, x_refsource_BID, x_transferred
ibm.com /support/docview.wss?uid=ibm10740033 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2018-1663
NVD: CVE-2018-1663

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.