IBM API Connect improper access control
CVE-2023-28522

4.3MEDIUM

Key Information:

Vendor

IBM
Status
Api Connect
Vendor
CVE Published:
12 May 2023

What is CVE-2023-28522?

IBM API Connect V10 experiences a significant access control vulnerability that could enable an authenticated user to engage in unauthorized actions, thus compromising data integrity and application security. This vulnerability highlights the importance of proper access controls in safeguarding sensitive APIs. Organizations utilizing this version of IBM's API management solution should review their configurations to mitigate potential risks associated with unauthorized access.

Affected Version(s)

API Connect 10.0.0.0 < 10.0.5.1

API Connect 10.0.1.4 < 10.0.1.9

References

https://www.ibm.com/support/pages/node/6965612
vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/250585
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.