PT-2019-17086 · Ibm · Ibm Api Connect

Publicado 2019-12-16 · Atualizado 2020-08-24 · CVE-2019-4444

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 2018.1 through 2018.4.1.7

Description The issue concerns the user registration page of the Developer Portal, which does not disable password autocomplete. This allows an attacker with access to the browser instance and local system credentials to potentially steal the credentials used for registration.

Recommendations For IBM API Connect versions 2018.1 through 2018.4.1.7, consider disabling the password autocomplete feature on the Developer Portal's user registration page as a temporary workaround until a patch is available. Restrict access to the registration page to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2019-4444

Produtos afetados

Ibm Api Connect

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-4444 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/163453 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-4444 · Nota de Segurança
• https://ibm.com/support/pages/node/1126833 · Aviso do Fabricante