CVE-2017-1591: IBM WebSphere DataPower Appliances 7.0.0 through 7.6 is vulnerable to cross-site scripting.

Security readout for executives and security teams

CVE-2017-1591 is a cross-site scripting issue in IBM WebSphere DataPower Appliances/DataPower Gateways versions 7.0.0 through 7.6. A user could place JavaScript into the Web UI, changing trusted-session behavior and potentially exposing credentials. Business risk depends on whether the management Web UI is reachable and who can authenticate to it. Exposure is most likely where affected DataPower management Web UIs are enabled and reachable by administrators or trusted users. Internet-facing or broadly reachable management interfaces would raise concern, but the provided sources do not confirm default exposure or deployment patterns. Treat this as a targeted management-plane risk, not a broad internet worm scenario based on the available evidence. Prioritize systems where DataPower administration is reachable beyond a tightly controlled admin network or where privileged credentials could be exposed. Mitigation focus: Check IBM advisory swg22008815 for supported fixed levels and vendor remediation guidance.; Upgrade or patch affected DataPower versions according to IBM guidance.; Restrict DataPower Web UI access to trusted administrative networks or VPNs..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.