CVE-2015-0149: Medium severity ibm api connect vulnerability

Published Mar 18, 2015

Updated

The developer portal in IBM API Management 3.0 before 3.0.4.1 does not properly restrict access to the public and private APIs, which allows remote authenticated users to obtain sensitive information or modify data via unspecified API calls.

Affected Software

5 affected components

IBM API Management=3.0.0.0

IBM API Management=3.0.2.0

IBM API Management=3.0.2.1

IBM API Management=3.0.3.0

IBM API Management=3.0.4.0

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21696693

Event History

Mar 18, 2015

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-0149?

The severity of CVE-2015-0149 is considered high due to the potential for unauthorized access to sensitive information.

How do I fix CVE-2015-0149?

To fix CVE-2015-0149, upgrade IBM API Management to version 3.0.4.1 or later where the issue has been addressed.

What are the affected versions for CVE-2015-0149?

CVE-2015-0149 affects IBM API Management versions 3.0.0.0, 3.0.2.0, 3.0.2.1, 3.0.3.0, and 3.0.4.0.

Can CVE-2015-0149 be exploited by remote authenticated users?

Yes, CVE-2015-0149 can be exploited by remote authenticated users to access private APIs and modify data.

What kind of data can be impacted by CVE-2015-0149?

CVE-2015-0149 can allow unauthorized users to obtain sensitive information that should be restricted.