Cross-Site Request Forgery Vulnerability in IBM API Connect
CVE-2020-4826

4.3MEDIUM

Key Information:

Vendor
IBM
Status
Api Connect
Vendor
CVE Published:
4 February 2021

Summary

IBM API Connect versions 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 are susceptible to cross-site request forgery (CSRF) attacks. This vulnerability could enable an attacker to perform unauthorized actions on behalf of a trusted user, potentially compromising the integrity of the web application and exploiting user permissions. Consequently, malicious entities could leverage this flaw to initiate unauthorized commands by deceiving an authenticated user, making it vital for affected users to apply necessary security patches and safeguard their API infrastructure.

Affected Version(s)

API Connect 2018.4.1.0

API Connect 2018.4.1.13

API Connect 10.0.0.0

References

https://www.ibm.com/support/pages/node/6410912
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/189840
vdb-entryx_refsource_XF

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.