PT-2018-14190 · Ibm · Loopback

Zbarbutos · Publicado 2018-12-20 · Atualizado 2019-10-09 · CVE-2018-1778

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM LoopBack versions 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4

Description The issue allows an attacker to bypass authentication if the AccessToken Model is exposed over a REST API. An attacker can create an AccessToken for any user, given they know the userId, and thus gain access to the user's data or privileges, including administrative privileges if the targeted user is an admin.

Recommendations For versions 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4, restrict access to the AccessToken Model over REST API to prevent unauthorized access. As a temporary workaround, consider disabling the exposure of the AccessToken Model over REST API until a fix is available. Avoid using the userId in the affected API endpoint until the issue is resolved.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2018-1778

Produtos afetados

Loopback

Referências · 5

• https://osv.dev/vulnerability/CVE-2018-1778 · Aviso do Fabricante
• http://securityfocus.com/bid/106313 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1778 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/148801 · Aviso do Fabricante
• http://ibm.com/support/docview.wss?uid=ibm10733883 · Aviso do Fabricante