CVE-2022-31775

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228359.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
IBM	DataPower Gateway	2018.4.1.0; 10.0.1.0; 10.0.2.0; 10.0.4.0; 10.5.0.0; 2018.4.1.20; 10.1.0.7

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/228359VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6608608Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/228359VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6608608Patch, Vendor Advisory

Timeline

Published: Aug 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-317768.8IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to se CVE-2022-317775.4A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary CVE-2022-317787.5Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the c CVE-2022-317797.5Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue CVE-2022-31787.8Buffer Over-read in GitHub repository gpac/gpac prior to 2.1.0-DEV.CVE-2022-317807.5Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue CVE-2022-317817.5Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Speci CVE-2022-317827.8ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.CVE-2022-317835.5Liblouis 3.21.0 has an out-of-bounds write in compileRule in compileTranslationTable.c, as demonstrated by lou_trace.CVE-2022-317849.8A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow CVE-2022-317866.1IdeaLMS 2022 allows reflected Cross Site Scripting (XSS) via the IdeaLMS/Class/Assessment/ PATH_INFO.CVE-2022-317879.8IdeaTMS 2022 is vulnerable to SQL Injection via the PATH_INFO