PT-2018-14190 · Ibm · Loopback

Zbarbutos · Published 2018-12-20 · Updated 2019-10-09 · CVE-2018-1778

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM LoopBack versions 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4

Description The issue allows an attacker to bypass authentication if the AccessToken Model is exposed over a REST API. An attacker can create an AccessToken for any user, given they know the userId, and thus gain access to the user's data or privileges, including administrative privileges if the targeted user is an admin.

Recommendations For versions 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4, restrict access to the AccessToken Model over REST API to prevent unauthorized access. As a temporary workaround, consider disabling the exposure of the AccessToken Model over REST API until a fix is available. Avoid using the userId in the affected API endpoint until the issue is resolved.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-1778

Affected Products

Loopback

References · 5

• https://osv.dev/vulnerability/CVE-2018-1778 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1778 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/148801 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=ibm10733883 · Vendor Advisory
• http://securityfocus.com/bid/106313 · Note