EUVD-2025-210545
GHSA-7pr3-cjqf-w984
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
Network-reachable gateway requires high-privilege credentials to submit XML; partial file disclosure and high availability impact from memory exhaustion; no integrity or scope change.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
Lifecycle Timeline
1DescriptionNVD
IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.
AnalysisAI
XML External Entity injection in IBM DataPower Gateway 10.5.0, 10.6.0, and 10.6CD allows a privileged authenticated user who can submit XML data to the gateway to either exfiltrate sensitive information from the underlying system or trigger memory exhaustion through recursive or large entity expansion. The vulnerability exists in the gateway's XML processing pipeline, a core function of this API/ESB platform. No public exploit code has been identified at time of analysis, and the vendor has released a patch documented in IBM Security Advisory 7278748.
Technical ContextAI
IBM DataPower Gateway is an enterprise-grade hardware and virtual appliance used as an API gateway, ESB, and XML processing engine predominantly in financial services and regulated industries. Its core function involves parsing and transforming XML documents, making CWE-611 (Improper Restriction of XML External Entity Reference) a natural exposure surface. XXE flaws arise when an XML parser is configured to resolve external entity references (DOCTYPE declarations referencing external URIs or local file paths) embedded in attacker-controlled XML. In this context, a privileged user can craft XML payloads that cause the parser to fetch local files (e.g., /etc/passwd, configuration files with credentials) or trigger billion-laughs-style entity expansion to exhaust heap memory. Affected CPEs are cpe:2.3:a:ibm:datapower_gateway_10.6cd:*:*:*:*:*:*:*:*, cpe:2.3:a:ibm:datapower_gateway_10.5.0:*:*:*:*:*:*:*:*, and cpe:2.3:a:ibm:datapower_gateway_10.6.0:*:*:*:*:*:*:*:*.
RemediationAI
Patch available per vendor advisory - apply the update described in IBM Security Advisory 7278748 at https://www.ibm.com/support/pages/node/7278748, which covers DataPower Gateway 10.5.0, 10.6.0, and 10.6CD. Exact patched version numbers are not independently confirmed from available data and must be verified in the advisory before deployment. As a compensating control where patching is not immediately possible, restrict access to the DataPower Gateway management and XML processing interfaces to a tightly controlled set of trusted privileged accounts and monitor for anomalous XML submissions containing DOCTYPE declarations or SYSTEM/PUBLIC entity references - most WAFs and XML gateways can be configured to strip or reject external entity declarations. Note that disabling external entity resolution at the gateway level (if configurable) would eliminate the XXE vector but may break legitimate processing pipelines that rely on external schemas or catalogs, so test thoroughly in non-production environments first.
More in Datapower Gateway 10 6Cd
View allShare
External POC / Exploit Code
Leaving vuln.today