PT-2019-16962 · Ibm · Ibm Api Connect

William Soderberg · Publicado 2019-04-15 · Atualizado 2023-01-30 · CVE-2019-4203

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 5.0.0.0 through 5.0.8.6

Description The issue allows app developers to exploit the Developer Portal and download arbitrary files from the host OS, potentially carrying out Server-Side Request Forgery (SSRF) attacks. SSRF attacks involve tricking a server into making requests to unintended locations, which can lead to unauthorized access to sensitive data or systems.

Recommendations For IBM API Connect versions 5.0.0.0 through 5.0.8.6, consider restricting access to the Developer Portal to minimize the risk of exploitation until a fix is available. As a temporary workaround, restrict the ability of app developers to download arbitrary files from the host OS. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2019-4203

Produtos afetados

Ibm Api Connect

Referências · 5

• https://osv.dev/vulnerability/CVE-2019-4203 · Aviso do Fabricante
• http://securityfocus.com/bid/107905 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-4203 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/159124 · Aviso do Fabricante
• https://ibm.com/support/docview.wss?uid=ibm10880569 · Aviso do Fabricante