IBM API Connect vulnerabilities

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability. This could allow a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This could allow a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper authentication flaw. Authentication checks are not sufficiently isolated between tenants, which could allow a user from one tenant to be accepted by another.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This could allow a remote authenticated attacker to access internal network services.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 use a hard-coded cryptographic key. This could allow a local attacker to obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. Destination checks on outbound requests can be bypassed, which could allow the server to reach internal systems that should be blocked.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to SQL injection due to improper neutralization of special elements in SQL commands, allowing a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 have improper authorization, allowing a remote authenticated attacker to bypass authorization checks and access or modify sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery due to improper neutralization of user-supplied input, allowing a remote attacker to relay unauthorized email messages.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 have improper certificate validation, allowing a remote authenticated attacker to bypass authentication. Certificate checks are not reliably performed in all cases, potentially allowing a connection to be accepted without proper authentication.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to path traversal, allowing a remote authenticated attacker to execute arbitrary code. File paths in uploaded content are insufficiently validated, potentially allowing files to be written outside the intended location and code to be executed.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 have improper authorization via user-controlled keys, allowing a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have improper certificate validation, allowing a remote attacker to bypass authentication and inject unauthorized configuration changes.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 have improper certificate validation, allowing a remote attacker to bypass security restrictions.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 allow a remote attacker to read arbitrary files on the server due to external control of a file name or path.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 is vulnerable to server-side request forgery (SSRF). A remote authenticated attacker could exploit this to obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 has incomplete input validation that can be bypassed. A remote authenticated attacker could use this to obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 is vulnerable to server-side request forgery (SSRF). A remote authenticated attacker could exploit this to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 has improper authentication. A remote authenticated attacker could bypass security restrictions.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 improperly validates user-supplied URLs. A remote authenticated attacker could use this to obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 lacks authentication for a critical function. A remote attacker could access sensitive configuration data and perform unauthorized actions.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 is vulnerable to XML External Entity (XXE) injection, which could allow a remote attacker to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 inserts sensitive information into log files, which could allow a local attacker to obtain sensitive credentials and compromise accounts.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contains an insecure direct object reference vulnerability that could allow a remote authenticated attacker to delete or overwrite arbitrary control-plane assets.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contains an insecure direct object reference vulnerability that could allow a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 relies on client-supplied information for authorization decisions, which could allow a remote authenticated attacker to modify tool configuration and cause a denial of service.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 has improper authorization that could allow a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 is vulnerable to server-side request forgery. A remote authenticated attacker could access internal resources and cause a denial of service.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 has improper validation of user-supplied input that could allow a remote attacker to perform server-side request forgery.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 improperly validates user-supplied URLs. A remote attacker could leverage this to obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 is vulnerable to server-side request forgery. A remote authenticated attacker could obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 is vulnerable to cross-site request forgery in the sign-in flow. The flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an attacker-controlled account.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 has broken object-level authorization that could allow a remote authenticated attacker to modify application API subscriptions.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 uses a hard-coded cryptographic key. A remote attacker could leverage this to obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 has improper certificate validation that could allow a remote attacker to obtain sensitive information and tamper with configuration.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 improperly validates certificates. A remote attacker could obtain sensitive credentials and manipulate tool responses.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 has broken object-level authorization. A remote authenticated attacker could obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 is vulnerable to server-side request forgery. A remote attacker could obtain sensitive information from internal network resources.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 is vulnerable to server-side request forgery. A remote authenticated attacker could obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 improperly validates input. Locations supplied when service definitions are imported are not sufficiently validated, which could allow the server to retrieve content it should not access.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 improperly validate user-supplied URLs. A remote authenticated attacker can cause the server to contact internal network resources.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 improperly validate user-supplied URLs. A remote authenticated attacker can probe internal network services.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 is vulnerable to path traversal that could allow a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF). A remote authenticated attacker could exploit this to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 suffer from broken object-level authorization (BOLA). Access checks do not confirm that the user is permitted to change the targeted profile, allowing a remote authenticated attacker to modify other users' profile information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an open redirect vulnerability in the OAuth 2.0 sign-in flow. The redirect address is not sufficiently validated, allowing a remote authenticated attacker to perform account takeover by sending authentication results to an attacker-controlled location.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 improperly verify cryptographic signatures. Identity information from a login provider is accepted without full signature verification, allowing a remote authenticated attacker to create unauthorized user accounts.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF). A remote authenticated attacker could exploit this to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF). A remote authenticated attacker could exploit this to obtain sensitive information.