PT-2017-14096 · Ibm · Ibm Api Connect

Publicado 2017-09-25 · Atualizado 2017-10-03 · CVE-2017-1555

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 5.0.0.0 through 5.0.7.2

Description The issue allows an authenticated user to generate an API token even when not subscribed to the application plan.

Recommendations For versions 5.0.0.0 through 5.0.7.2, consider restricting access to API token generation to only subscribed users as a temporary workaround until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-1555

Produtos afetados

Ibm Api Connect

Referências · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/131545 · Aviso do Fabricante
• http://ibm.com/support/docview.wss?uid=swg22008588 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-1555 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1555 · Nota de Segurança
• http://securityfocus.com/bid/100973 · Nota