PT-2020-18178 · Ibm · Api Connect

Published 2020-09-03 · Updated 2021-07-21 · CVE-2020-4638

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM API Connect's API Manager versions 2018.4.1.0 through 2018.4.1.12

Description The issue allows an invitee to an API Provider organization to escalate privileges by manipulating the invitation link.

Recommendations For versions 2018.4.1.0 through 2018.4.1.12, update to a version that contains a fix for this issue to prevent privilege escalation.

Fix

Related Identifiers

CVE-2020-4638

Affected Products

Api Connect

References · 4

• https://ibm.com/support/pages/node/6324751 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4638 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4638 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/185508 · Vendor Advisory