PT-2014-5035 · Ibm · Ibm Api Management

Published 2014-06-08 · Updated 2017-08-29 · CVE-2014-3036

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM API Management version 3.0.0.0

Description The issue allows remote attackers to bypass intended restrictions on topology access and obtain sensitive information when basic authentication is used for APIs.

Recommendations For IBM API Management version 3.0.0.0, consider disabling basic authentication for APIs until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2014-3036

Affected Products

Ibm Api Management

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-3036 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21674232 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1LI78000 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/93302 · Note
• http://secunia.com/advisories/59044 · Note
• http://securityfocus.com/bid/67941 · Note