CVE-2017-1161
HighSummary
IBM API Connect version 5.0.6.0 could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of URLs for the Developer Portal. An attacker could exploit this vulnerability by crafting a malicious URL.
Risk Assessment
This vulnerability could lead to unauthorized access and execution of commands with the privileges of the www-data user, posing a serious security threat to the system.
Recommendation
It is recommended to update IBM API Connect to the latest version and implement proper URL validation mechanisms to minimize risk.
Other vulnerabilities in IBM API Connect 5.0.6.0
See all- CVE-2017-1322High
IBM API Connect version 5.0.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- CVE-2017-1379High
IBM API Connect version 5.0.0.0 could allow a remote attacker to obtain sensitive information due to improper handling of requests to the Developer Portal.
- CVE-2026-9074Critical
IBM API Connect versions 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contain an unauthenticated SQL injection vulnerability in the password reset functionality.
- CVE-2025-13915Critical
IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.
- CVE-2026-3144High
IBM API Connect versions 12.1.0.0 through 12.1.0.3 use default credentials, which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update.
Original NVD description (English source)
IBM API Connect 5.0.6.0 could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of URLs for the Developer Portal. By crafting a malicious URL, an attacker could exploit this vulnerability to execute arbitrary commands on the system with the privileges of the www-data user. IBM X-Force ID: 122956.