EUVD-2025-209176
GHSA-558v-r8m2-hmjm
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Lifecycle Timeline
4Description
IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Analysis
IBM DataPower Gateway versions 10.5.0.0-10.5.0.20, 10.6.0.0-10.6.0.8, and 10.6.1.0-10.6.5.0 are vulnerable to cross-site request forgery (CSRF) that allows unauthenticated remote attackers to execute unauthorized actions on behalf of trusted users with user interaction. The vulnerability carries a CVSS score of 6.5 with medium real-world risk due to the requirement for user interaction and the integrity-only impact.
Technical Context
The vulnerability is rooted in CWE-352 (Cross-Site Request Forgery), a web security flaw where an attacker crafts a malicious request and tricks a legitimate user into executing it against a trusted application. In DataPower Gateway, the absence of or improper validation of anti-CSRF tokens (such as synchronizer tokens or SameSite cookie attributes) enables an attacker to forge requests that modify gateway configuration, policies, or other administrative functions. The affected products (CPE: cpe:2.3:a:ibm:datapower_gateway_10.5.0:*:*:*:*:*:*:*:*, cpe:2.3:a:ibm:datapower_gateway_10.6.0:*:*:*:*:*:*:*:*, cpe:2.3:a:ibm:datapower_gateway_10.6cd:*:*:*:*:*:*:*:*) are enterprise API management and integration platforms where CSRF protection is critical because they often manage sensitive security policies and integrations.
Affected Products
IBM DataPower Gateway 10.5.0 versions 10.5.0.0 through 10.5.0.20, IBM DataPower Gateway 10.6.0 versions 10.6.0.0 through 10.6.0.8, and IBM DataPower Gateway 10.6CD versions 10.6.1.0 through 10.6.5.0 are vulnerable. Refer to IBM's security advisory at https://www.ibm.com/support/pages/node/7268034 for precise version identification and remediation guidance.
Remediation
Vendor-released patch available per IBM security advisory. Organizations should upgrade to patched versions of IBM DataPower Gateway 10.5.0 (beyond 10.5.0.20), 10.6.0 (beyond 10.6.0.8), or 10.6CD (beyond 10.6.5.0) as directed by IBM's advisory at https://www.ibm.com/support/pages/node/7268034. As an interim control, restrict administrative access to DataPower Gateway to trusted networks or require multi-factor authentication to reduce the risk that compromised credentials or social engineering can lead to unauthorized actions. Additionally, educate administrators to avoid clicking links from untrusted sources while authenticated to the gateway.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today