CVE-2018-1789 - IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack

Back Back to CVE browser

CRITICAL

IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack

Published Sep 7, 2018

9.9

CRITICAL

CVSS 3.0

EPSS 1.23%

Description

IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack. IBM X-Force ID: 148939.

Affected products

Vendor IBM Product API Connect Default
n/a
- Version
  2018.1.0
  Status
  affected
  Constraints
  -
- Version
  2018.2.1
  Status
  affected
  Constraints
  -
- Version
  2018.2.10
  Status
  affected
  Constraints
  -
- Version
  2018.2.11
  Status
  affected
  Constraints
  -
- Version
  2018.2.2
  Status
  affected
  Constraints
  -
- Version
  2018.2.3
  Status
  affected
  Constraints
  -
- Version
  2018.2.4
  Status
  affected
  Constraints
  -
- Version
  2018.2.5
  Status
  affected
  Constraints
  -
- Version
  2018.2.6
  Status
  affected
  Constraints
  -
- Version
  2018.2.7
  Status
  affected
  Constraints
  -
- Version
  2018.2.8
  Status
  affected
  Constraints
  -
- Version
  2018.2.9
  Status
  affected
  Constraints
  -
- Version
  2018.3.1
  Status
  affected
  Constraints
  -
- Version
  2018.3.2
  Status
  affected
  Constraints
  -
- Version
  2018.3.3
  Status
  affected
  Constraints
  -
- Version
  2018.3.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

API Connect

n/a

Version	Status	Constraints
2018.1.0	affected	-
2018.2.1	affected	-
2018.2.10	affected	-
2018.2.11	affected	-
2018.2.2	affected	-
2018.2.3	affected	-
2018.2.4	affected	-
2018.2.5	affected	-
2018.2.6	affected	-
2018.2.7	affected	-
2018.2.8	affected	-
2018.2.9	affected	-
2018.3.1	affected	-
2018.3.2	affected	-
2018.3.3	affected	-
2018.3.4	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-12368
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/148939
vdb-entryx_refsource_XFVDB EntryVendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10728517
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-12368		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/148939		vdb-entryx_refsource_XFVDB EntryVendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10728517		x_refsource_CONFIRMPatchVendor Advisory