description: IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input parameters can trick the server into making potentially malicious calls within the trusted network. IBM X-Force ID: 146370.
problem types: Obtain Information
affected:
{
product: API Connect
vendor: IBM
versions:
status: affected, version: 5.0.1.0
status: affected, version: 5.0.0.0
status: affected, version: 5.0.0.1
status: affected, version: 5.0.2.0
status: affected, version: 5.0.5.0
status: affected, version: 5.0.6.0
status: affected, version: 5.0.6.1
status: affected, version: 5.0.6.2
status: affected, version: 5.0.7.0
status: affected, version: 5.0.7.1
status: affected, version: 5.0.3.0
status: affected, version: 5.0.4.0
status: affected, version: 5.0.7.2
status: affected, version: 5.0.6.3
status: affected, version: 5.0.6.4
status: affected, version: 5.0.8.0
status: affected, version: 5.0.8.1
status: affected, version: 5.0.6.5
status: affected, version: 5.0.6.6
status: affected, version: 5.0.8.2
status: affected, version: 5.0.8.3
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: UNPROVEN
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 7.5
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.0/A:L/AC:L/AV:N/C:H/I:L/PR:N/S:U/UI:N/E:U/RC:C/RL:O
version: 3.0
]