CVE-2015-1970

The IBM WebSphere DataPower XC10 appliance 2.1 through 2.1.0.3 and 2.5 through 2.5.0.4 retains data on SSD cards, which might allow physically proximate attackers to obtain sensitive information by extracting a card and attaching it elsewhere.

CVSS v2.0 2.1 LOW

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg1IT09803
http://www-01.ibm.com/support/docview.wss?uid=swg21962861	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.1.0.0:::::::*
	cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.1.0.1:::::::*
	cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.1.0.2:::::::*
	cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.1.0.3:::::::*
	cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.5.0.0:::::::*
	cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.5.0.1:::::::*
	cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.5.0.2:::::::*
	cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.5.0.3:::::::*
	cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.5.0.4:::::::*

History

No history.

Information

Published : 2015-08-03 19:59

Updated : 2024-02-04 18:53

NVD link : CVE-2015-1970

Mitre link : CVE-2015-1970

CVE.ORG link : CVE-2015-1970

JSON object : View

Products Affected

ibm

websphere_datapower_xc10_appliance_firmware

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2015-1970", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-08-03T19:59:02.923", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IT09803", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21962861", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The IBM WebSphere DataPower XC10 appliance 2.1 through 2.1.0.3 and 2.5 through 2.5.0.4 retains data on SSD cards, which might allow physically proximate attackers to obtain sensitive information by extracting a card and attaching it elsewhere."}, {"lang": "es", "value": "El dispositivo IBM WebSpher DataPower XC10 2.1 hasta la versi\u00f3n 2.1.0.3 y 2.5 hasta la versi\u00f3n 2.5.0.4, retiene los datos en tarjetas SSD, lo que podr\u00eda permitir a atacantes f\u00edsicamente pr\u00f3ximos obtener informaci\u00f3n sensible mediante la extracci\u00f3n de una tarjeta y su conexi\u00f3n en otro lugar."}], "lastModified": "2015-08-04T19:20:59.807", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BE4337E-3172-477D-95A9-44704CF9A0B9"}, {"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F7A0A8E-F6AA-4AC7-BC38-69F7D6511CE5"}, {"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.1.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6BFA52E5-BE68-4824-9A30-F60A63972400"}, {"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.1.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15E0FBCC-8E8C-4F53-8413-B47177785680"}, {"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.5.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC82F650-DD87-44D7-8403-DEE82934B05B"}, {"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.5.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "626658CE-C02C-4843-8AAD-AA87312706D9"}, {"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.5.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44A45B9A-558E-45C7-B099-350ACE289931"}, {"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.5.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ECC4E619-78C0-491D-BDFB-03BB9505759E"}, {"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.5.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8B51541-BDD9-40E8-AAF9-72FE180D3C1F"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}