Skip to main content

Websphere Datapower Xc10 Appliance CVE-2014-3060

CRITICAL
2014-10-02 psirt@us.ibm.com
Information Disclosure IBM Websphere Datapower Xc10 Appliance Websphere Datapower Xc10 Appliance Firmware
10.0
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
10.0 CRITICAL
AV:N/AC:L/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Confidentiality
C
Integrity
C
Availability
C

Lifecycle Timeline

1
CVE Published
Oct 02, 2014 - 00:55 cve.org
CRITICAL 10.0

DescriptionCVE.org

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie.

AnalysisAI

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity.

Technical ContextAI

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie. Affected products include: Ibm Websphere Datapower Xc10 Appliance Firmware, Ibm Websphere Datapower Xc10 Appliance.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Websphere Datapower Xc10 Appliance

View all
CVE-2014-3059 CRITICAL
10.0 Oct 02

Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote

CVE-2013-5446 CRITICAL
10.0 Oct 22

The console on IBM WebSphere DataPower XC10 appliances 2.1.0 and 2.5.0 does not properly process logoff actions, which h
CVE-2013-0600 CRITICAL
9.3 May 09

Unspecified vulnerability on IBM WebSphere DataPower XC10 Appliance devices 2.0 and 2.1 through 2.1 FP3 allows remote at
CVE-2012-5759 CRITICAL
9.0 Nov 23

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2 allows remote authenticat
CVE-2012-5758 HIGH
7.8 Nov 23

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2 does not require authenti
CVE-2013-0499 MEDIUM POC
4.3 May 28

Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmwa
CVE-2013-5428 HIGH
7.1 Oct 22

IBM WebSphere DataPower XC10 appliances 2.5.0 do not require authentication for all administrative actions, which allows
CVE-2012-5756 MEDIUM
4.3 Nov 23

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2, when a collective config

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2014-3060 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy