Unrated severityNVD Advisory· Published Dec 11, 2014· Updated Jun 17, 2026

CVE-2014-3058

Description

Cross-site request forgery (CSRF) vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Affected products

IBM/Websphere Datapower Xc10 Appliance Firmware2 versions
cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.1.0.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.1.0.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:2.5.0.0:*:*:*:*:*:*:*
IBM/Websphere Datapower Xc10 Appliancellm-fuzzy
Range: 2.1, 2.5 before FP4

Patches

Vulnerability mechanics

References

www-01.ibm.com/support/docview.wssnvdVendor Advisory
www-01.ibm.com/support/docview.wssnvd
exchange.xforce.ibmcloud.com/vulnerabilities/93532nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000