Improper Member Registration in IBM API Connect Products
CVE-2021-20440

6.4MEDIUM

Key Information:

Vendor
IBM
Status
Api Connect
Vendor
CVE Published:
15 March 2021

Summary

IBM API Connect versions 10.0.0.0 and 2018.4.1.0 through 2018.4.1.13 are affected by a vulnerability that allows a valid user to exploit a stolen invitation link. This could enable the attacker to register themselves as a member of an API provider organization, bypassing intended user registration controls. This flaw underscores the importance of robust access control measures to protect sensitive API interactions.

Affected Version(s)

API Connect 2018.4.1.0

API Connect 2018.4.1.13

API Connect 10.0.0.0

References

https://www.ibm.com/support/pages/node/6430107
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/196536
vdb-entryx_refsource_XF

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.