IBM API Connect vulnerabilities

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF) due to insufficient validation of user-supplied addresses. The server could be made to send requests to unintended destinations and return the results, allowing a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 improperly validate external references. When schemas are validated, references to external resources are not sufficiently restricted, which could allow the server to retrieve content it should not access, enabling a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 improperly validate client-supplied information. Tenant context is not sufficiently verified, which could allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 suffer from broken object-level authorization (BOLA). A remote authenticated attacker could exploit this to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a broken object-level authorization flaw. A remote authenticated attacker can obtain sensitive information belonging to other objects.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery. A remote authenticated attacker can exploit this to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not properly restrict excessive authentication attempts. A remote attacker can perform unauthenticated brute-force attacks to obtain valid credentials.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to cause a denial of service through uncontrolled resource consumption. Certain requests can stall internal processing and make the service unavailable.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not verify that a user is permitted to act on the targeted resource. A remote authenticated attacker can perform unauthorized actions and obtain sensitive information, including deleting other users' API keys.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 has improper authorization. A remote authenticated attacker can obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 has improper authentication. A remote attacker can bypass security restrictions because authentication checks are not applied consistently.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 improperly validates path parameters. A remote authenticated attacker can obtain sensitive information from other tenants.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 is vulnerable to server-side request forgery. A remote authenticated attacker can obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 does not apply authorization checks when certain organization URLs are resolved. A remote authenticated attacker can access information belonging to others.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 improperly validates user-supplied URLs. A remote authenticated attacker can obtain information about internal network services.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 improperly neutralizes special elements in a request. A remote attacker can bypass security restrictions using specially formed request parameters.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 exhibits an observable response discrepancy. A remote attacker can leverage this observable difference to obtain sensitive information.

A path traversal vulnerability in IBM API Connect allows a remote authenticated attacker to obtain sensitive information. The issue affects versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery. Destination restrictions on outbound requests can be bypassed, allowing the server to retrieve content from unintended resources.

Insufficient validation of request parameters in IBM API Connect allows a remote authenticated attacker to bypass security restrictions and access unauthorized analytics queries. The issue affects versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

IBM API Connect returns overly verbose error messages, allowing a remote authenticated attacker to obtain sensitive system information. The issue affects versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

An LDAP injection vulnerability in IBM API Connect allows a remote attacker to bypass security restrictions. The issue affects versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

Incorrect type conversion in IBM API Connect allows a remote authenticated attacker to cause a denial of service. A value converted incorrectly between two types may cause the service to return invalid responses or become unavailable. The issue affects versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

Observable differences in response behavior in IBM API Connect allow a remote attacker to enumerate usernames. The issue affects versions 12.1.0.0 through 12.1.1.2.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not sufficiently sanitize provider-supplied HTML content before display. A remote authenticated attacker can execute arbitrary JavaScript in the user's browser (XSS).

IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not sufficiently restrict references to external resources when service definitions are imported. A remote authenticated attacker can exploit SSRF to make the server request resources it should not access.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 improperly validate user-supplied URLs. A remote authenticated attacker can exploit this to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not sufficiently verify client-supplied information. A remote authenticated attacker can bypass security restrictions and impersonate another party.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to falsify audit log information due to reliance on untrusted inputs. Client-supplied data is relied on when recording the source of a request, so audit records could contain inaccurate details.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of user-controlled input.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform cross-site scripting due to improper neutralization of user-supplied input.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform HTML injection due to improper neutralization of user-supplied input.

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 has improper control of code generation, so user-supplied input can influence generated code. This could allow a remote authenticated attacker to execute arbitrary code.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to improper use of cryptography. The encryption applied to stored data is not implemented with sufficient strength, which weakens its protection.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an insecure direct object reference vulnerability. A remote authenticated attacker could obtain sensitive information and cause a denial of service.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to the insertion of sensitive information into log files.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to the generation of error messages containing sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have a broken object-level authorization vulnerability. A remote authenticated attacker could obtain sensitive information belonging to other tenants.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery. A remote authenticated attacker could use this to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to verbose error messages.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 improperly handle case sensitivity, so access restrictions are not applied consistently to all input variations. A remote authenticated attacker can bypass security restrictions and send unauthorized emails.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 is vulnerable to server-side request forgery (SSRF). A remote authenticated attacker can use this to access internal network resources.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contains an insecure direct object reference (IDOR) vulnerability. A remote authenticated attacker can obtain sensitive information.

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 does not properly neutralize argument delimiters. Special characters in user-supplied input are not handled safely, which could allow additional parameters to be added to a server-made request.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery. A remote authenticated attacker could obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability. A remote authenticated attacker could obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 have an injection vulnerability. Input used to build a data query is not properly neutralized, which could allow the query to return data the user is not permitted to see.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 is vulnerable to path traversal. A remote attacker can view arbitrary files on the system, accessing directories outside the intended location via a specially crafted URL request.