description: Certain IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 configurations can result in sensitive information in the URL fragment identifiers. This information can be cached in the intermediate nodes like proxy servers, cdn, logging platforms, etc. An attacker can make use of this information to perform attacks by impersonating a user. IBM X-Force ID: 185510.
problem types: Obtain Information
affected:
{
product: API Connect
vendor: IBM
versions:
status: affected, version: 2018.4.1.0
status: affected, version: 2018.4.1.13
status: affected, version: 10.0.0.0
status: affected, version: 10.0.1.0
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 3.4
baseSeverity: LOW
confidentialityImpact: LOW
exploitCodeMaturity: UNPROVEN
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 3
temporalSeverity: LOW
userInteraction: REQUIRED
vectorString: CVSS:3.0/PR:L/AC:H/UI:R/S:U/I:L/A:N/C:L/AV:A/RC:C/RL:O/E:U
version: 3.0
]