Cross-Site Scripting in IBM API Connect Web UI
CVE-2020-4825

5.4MEDIUM

Key Information:

Vendor
IBM
Status
Api Connect
Vendor
CVE Published:
4 February 2021

Summary

IBM API Connect versions from 10.0.0.0 to 10.0.1.0 and 2018.4.1.0 to 2018.4.1.13 are susceptible to a serious cross-site scripting vulnerability. This flaw allows attackers to inject arbitrary JavaScript code into the Web UI, potentially altering the application's intended functionality. Such alterations can result in sensitive data exposure, including user credentials, within a trusted session. It is crucial that users of the affected versions review their security posture and apply necessary patches or mitigations available from IBM to safeguard against this vulnerability.

Affected Version(s)

API Connect 2018.4.1.0

API Connect 2018.4.1.13

API Connect 10.0.0.0

References

https://www.ibm.com/support/pages/node/6410506
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/189839
vdb-entryx_refsource_XF

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.