CVE-2018-1778

Опубликовано: 20 дек. 2018

Источник: nvd

CVSS3: 7.7

CVSS3: 8.1

CVSS2: 9.3

EPSS Низкий

Описание

IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication if the AccessToken Model is exposed over a REST API, it is then possible for anyone to create an AccessToken for any User provided they know the userId and can hence get access to the other userÃ¢Â�Â�s data / access to their privileges (if the user happens to be an Admin for example). IBM X-Force ID: 148801.

Ссылки

http://www.ibm.com/support/docview.wss?uid=ibm10733883
Patch
Vendor Advisory
http://www.securityfocus.com/bid/106313
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/148801
VDB Entry
Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10733883
Patch
Vendor Advisory
http://www.securityfocus.com/bid/106313
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/148801
VDB Entry
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*

Версия от 5.0.8.0 (включая) до 5.0.8.4 (включая)

cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*

Версия от 2018.1.0 (включая) до 2018.4.1.0 (включая)

EPSS

Процентиль: 57%

0.00349

Низкий

7.7 High

CVSS3

8.1 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-287

Связанные уязвимости

GHSA-gpvh-xcx4-jwmg

CVSS3: 8.1

github

больше 3 лет назад

IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication if the AccessToken Model is exposed over a REST API, it is then possible for anyone to create an AccessToken for any User provided they know the userId and can hence get access to the other userÃ¢ÂÂs data / access to their privileges (if the user happens to be an Admin for example). IBM X-Force ID: 148801.

EPSS

Процентиль: 57%

0.00349

Низкий

7.7 High

CVSS3

8.1 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-287