PT-2019-16962 · Ibm · Ibm Api Connect

William Soderberg · Published 2019-04-15 · Updated 2023-01-30 · CVE-2019-4203

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 5.0.0.0 through 5.0.8.6

Description The issue allows app developers to exploit the Developer Portal and download arbitrary files from the host OS, potentially carrying out Server-Side Request Forgery (SSRF) attacks. SSRF attacks involve tricking a server into making requests to unintended locations, which can lead to unauthorized access to sensitive data or systems.

Recommendations For IBM API Connect versions 5.0.0.0 through 5.0.8.6, consider restricting access to the Developer Portal to minimize the risk of exploitation until a fix is available. As a temporary workaround, restrict the ability of app developers to download arbitrary files from the host OS. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2019-4203

Affected Products

Ibm Api Connect

References · 5

• https://osv.dev/vulnerability/CVE-2019-4203 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-4203 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/159124 · Vendor Advisory
• https://ibm.com/support/docview.wss?uid=ibm10880569 · Vendor Advisory
• http://securityfocus.com/bid/107905 · Note