PT-2018-15063 · Ibm · Ibm Api Connect

Publicado 2018-12-20 · Atualizado 2019-10-09 · CVE-2018-1973

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 5.0.0.0 through 5.0.8.4

Description The issue allows a user with limited 'API Administrator' level access to escalate their privileges to full 'Administrator' level access. This is achieved through the members functionality.

Recommendations For versions 5.0.0.0 through 5.0.8.4, consider restricting access to the members functionality to prevent privilege escalation until a fix is available.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2018-1973

Produtos afetados

Ibm Api Connect

Referências · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/153914 · Aviso do Fabricante
• https://ibm.com/support/docview.wss?uid=ibm10788339 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1973 · Aviso do Fabricante
• http://securityfocus.com/bid/106281 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1973 · Nota de Segurança