PT-2018-13905 · Ibm · Ibm Api Connect'S Developer Portal

David Azria · Published 2018-08-16 · Updated 2019-10-09 · CVE-2018-1712

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions IBM API Connect's Developer Portal versions 5.0.0.0 through 5.0.8.3

Description The issue allows an attacker to trick the server into making potentially malicious calls within the trusted network by using specially crafted input parameters. This can be exploited through Server Side Request Forgery.

Recommendations For versions 5.0.0.0 through 5.0.8.3, update to a version that contains a fix for this issue to prevent Server Side Request Forgery attacks.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-1712

Affected Products

Ibm Api Connect'S Developer Portal

References · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/146370 · Vendor Advisory
• https://www-01.ibm.com/support/docview.wss?uid=ibm10716169 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1712 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1712 · Security Note