CVE-2015-7412

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-11-08 · updated 2026-06-17
Weakness: CWE-200

Description

The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext data, which makes it easier for remote attackers to obtain plaintext data via a padding-oracle attack.

Affected products

IBM DataPower Gateway 11.0.0: through 7.2.0.0

References

http://www-01.ibm.com/support/docview.wss?uid=swg1IT10701
http://www-01.ibm.com/support/docview.wss?uid=swg21964170
http://www-01.ibm.com/support/docview.wss?uid=swg1IT10701
http://www-01.ibm.com/support/docview.wss?uid=swg21964170

Get alerted when CVE-2015-7412 or the next vulnerability affects your stack