PT-2019-16838 · Ibm · Api Connect

Published 2019-02-07 · Updated 2022-12-03 · CVE-2019-4008

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions API Connect versions 2018.1 through 2018.4.1.1

Description The issue concerns an access token leak. Authorization tokens in some URLs can result in the tokens being written to log files.

Recommendations For API Connect versions 2018.1 through 2018.4.1.1, consider restricting access to log files to minimize the risk of exploitation. As a temporary workaround, review and configure logging settings to avoid writing authorization tokens to log files until a patch is available.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2019-4008

Affected Products

Api Connect

References · 6

• https://osv.dev/vulnerability/CVE-2019-4008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-4008 · Security Note
• https://ibm.com/support/docview.wss?uid=ibm10869772 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/155626 · Vendor Advisory
• https://t.me/cvenotify/39063 · Telegram Post
• http://securityfocus.com/bid/106961 · Note