CVE-2020-5014 Server-side request forgery in DataPower Gateway

What is CVE-2020-5014?

CVE-2020-5014 is a medium-severity server-side request forgery vulnerability in Ibm Datapower Gateway, published on 8 Mar 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

IBM DataPower Gateway V10 and V2018 could allow a local attacker with administrative privileges to execute arbitrary code on the system using a server-side requesr forgery attack. IBM X-Force ID: 193247.

Weakness: CWE-918

Which versions are affected by CVE-2020-5014?

It affects 1 product.

Products include Ibm Datapower Gateway.

How do I fix CVE-2020-5014?

No fix has been published for CVE-2020-5014 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2020-5014 being exploited?

There is no known exploitation of CVE-2020-5014 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Ibm Datapower Gateway

• CVE-2026-14269 IBM DataPower Gateway Buffer Overflow Critical 9.8
• CVE-2026-14502 IBM DataPower Gateway Improper Authentication Critical 9.8
• CVE-2026-14991 IBM DataPower Gateway Out-of-bounds Write Critical 9.8
• CVE-2026-14992 IBM DataPower Gateway Out-of-bounds Write Critical 9.8
• CVE-2026-15762 IBM DataPower Gateway Out-of-bounds Write Critical 9.8

All Ibm Datapower Gateway vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pmxx-phjp-rphc.