PT-2018-14197 · Ibm · Ibm Api Connect

Published 2018-11-20 · Updated 2020-08-24 · CVE-2018-1779

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 2018.1 through 2018.3.7

Description The issue allows an unauthenticated attacker to cause a denial of service due to not setting limits on JSON payload size.

Recommendations For versions 2018.1 through 2018.3.7, consider setting limits on JSON payload size to prevent denial of service attacks. As a temporary workaround, restrict access to the API to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2018-1779

Affected Products

Ibm Api Connect

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-1779 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1779 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/148802 · Vendor Advisory
• https://ibm.com/support/docview.wss?uid=ibm10733851 · Vendor Advisory
• http://securityfocus.com/bid/105991 · Note