QwikSec

Security Database

CVE

CWE

Training

CVE-2015-7412

Published: Nov 8, 2015

Modified: Aug 6, 2024

PUBLISHED

Description

The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext data, which makes it easier for remote attackers to obtain plaintext data via a padding-oracle attack.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://www-01.ibm.com/support/docview.wss?uid=swg21964170

x_refsource_CONFIRM

vendor-advisory

x_refsource_AIXAPAR

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

CVE-2015-7412 - Security Vulnerability | QwikSec