A flaw in IBM DataPower Gateway allows a cross‑site request forgery attack that can compel a legitimate authenticated user to perform privileged operations without the user’s knowledge. This vulnerability, classified as CWE‑352, permits attackers to inject malicious requests and execute unintended administrative actions within the gateway, potentially leading to configuration tampering or unauthorized data disclosure.

IBM DataPower Gateway 10.5.0 versions 10.5.0.0 through 10.5.0.20, 10.6.0 versions 10.6.0.0 through 10.6.0.8, and 10.6CD versions 10.6.1.0 through 10.6.5.0 are impacted.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score below 1% suggests low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The description does not specify the exact attack vector, so the likely scenario is an attacker sending a crafted HTTP request—either directly from a malicious web page or via phishing—to a user who is logged into the gateway, exploiting the CSRF weakness to perform privileged actions without additional authentication.