Skip to content
OpenAdvisories
Unscored CVE-2015-7412 EUVD-2015-7336GHSA-f3p8-fp2x-p8xg

The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE de…

Published Nov 8, 2015 · Updated Aug 6, 2024 · Assigned by ibm

Description

The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext data, which makes it easier for remote attackers to obtain plaintext data via a padding-oracle attack.

References