IBM API Connect vulnerabilities

IBM API Connect versions 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contain an unauthenticated SQL injection vulnerability in the password reset functionality.

IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.

IBM API Connect 12.1.0.0 through 12.1.1.2 is vulnerable to server-side request forgery; the protection blocking requests to internal addresses can be bypassed, allowing a remote attacker to access internal network resources and obtain sensitive information.

IBM API Connect 12.1.0.0 through 12.1.1.2 allows low-privileged users to query arbitrary indices and read sensitive data due to missing authorization. The flaw enables unauthorized access to information.

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allows a network-positioned attacker to intercept backup data due to improper verification of the backup server's identity. The server identity is not verified when establishing the secure connection for analytics backups, potentially allowing backup data and credentials to be intercepted.

IBM API Connect 12.1.0.0 through 12.1.1.2 is vulnerable to server-side request forgery, allowing an authenticated attacker to send unauthorized requests from the system.

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

IBM API Connect 10.0.8.0 through 10.0.8.12 allows an attacker with access to stored data to decrypt sensitive credentials due to the use of a hard-coded cryptographic key. The key protecting stored credentials is built into the product, so credentials could be decrypted if the stored data is obtained.

IBM API Connect 12.1.0.0 through 12.1.1.2 is vulnerable to server-side request forgery, allowing an authenticated privileged attacker to send unauthorized requests from the system. This could be used to enumerate network resources or support further attacks.

IBM API Connect 12.1.0.0 through 12.1.1.2 has improper authorization because tenant context is not sufficiently verified against the authenticated user, allowing unauthorized access to another tenant's resources.

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, potentially revealing the names of other organizations.

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, potentially allowing access to information belonging to others.

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 is vulnerable to SQL injection because input is not properly neutralized before use in database queries, allowing an authenticated attacker to view, add, modify, or delete information in the back-end database.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, allowing a remote authenticated attacker to execute arbitrary SQL commands.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 is vulnerable to server-side request forgery. Address checks can be bypassed, allowing the server to reach destinations that should be blocked and enabling a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 suffers from broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, potentially exposing keystore information to a remote authenticated attacker.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 is vulnerable to server-side request forgery. A remote authenticated attacker could exploit this to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contains a stack-based buffer overflow. A remote authenticated attacker could exploit this to execute arbitrary code.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 is vulnerable to SQL injection. A remote authenticated attacker could exploit this to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 is vulnerable to server-side request forgery. A remote authenticated attacker could exploit this to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 is vulnerable to server-side request forgery. A remote authenticated attacker could exploit this to obtain sensitive information.

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, potentially allowing the server to be made to contact internal systems.

IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a local attacker to obtain sensitive information due to the use of a cryptographically weak pseudo-random number generator. The weakness may enable prediction of values and disclosure of data.

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. The flaw enables access to objects the attacker should not be authorized to access.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a cross-site scripting vulnerability. An authenticated user can execute arbitrary JavaScript in the web UI, which could alter the intended functionality of the page and potentially lead to credential disclosure within a trusted session.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to LDAP injection. Input is not properly neutralized in directory lookups, which could cause queries to return additional data from the connected LDAP directory.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 suffers from broken object-level authorization. A remote authenticated attacker could exploit this to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 suffers from broken object-level authorization. A remote authenticated attacker could exploit this to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 use a cryptographically weak pseudo-random number generator. This could allow a remote attacker to gain full administrative control.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery. A remote authenticated attacker could obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 contain a server-side request forgery vulnerability. A remote authenticated attacker could obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have broken object-level authorization. A remote authenticated attacker could obtain sensitive information from other tenants.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to path traversal. A remote authenticated attacker could obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have improper authorization validation using user-controlled keys. A remote authenticated attacker could obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not sufficiently validate a path parameter. A remote authenticated attacker could access sensitive information belonging to other tenants.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 improperly verify cryptographic signatures. A remote attacker could bypass authentication and assign arbitrary roles.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have broken object-level authorization. A remote authenticated attacker could obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not properly neutralize output for logs. A remote authenticated attacker could forge audit records.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have broken object-level authorization. A remote authenticated attacker could obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper authorization flaw. Authorization decisions rely on client-supplied information, which could allow a remote authenticated attacker to access information the user should not see.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a broken object-level authorization flaw. This could allow a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper authorization flaw. This could allow a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 insufficiently validate webhook destination URLs. A remote authenticated attacker could make the server contact internal network resources.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 suffer from broken object-level authorization. A remote authenticated attacker could obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have improper authentication in the sign-in flow. The flow does not sufficiently verify the identity of the user completing it, which could allow another user's access token to be obtained.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to cross-site request forgery in the sign-in flow. The flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an attacker-controlled account.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery. A remote authenticated attacker could make the server send requests to unintended destinations and return the results, enabling network reconnaissance and disclosure of sensitive credentials.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 store credentials with insufficient protection. A remote authenticated attacker could obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 suffer from broken object-level authorization. A remote authenticated attacker could obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This could allow a remote authenticated attacker to obtain sensitive information.