CVE-2017-1555: Input Validation
Published Sep 25, 2017
·Updated
IBM API Connect 5.0.0.0 through 5.0.7.2 could allow an authenticated user to generate an API token when not subscribed to the application plan. IBM X-Force ID: 131545.
Affected Software
15 affected components
IBM API Connect=5.0.0.0
IBM API Connect=5.0.0.1
IBM API Connect=5.0.1.0
IBM API Connect=5.0.2.0
IBM API Connect=5.0.3.0
IBM API Connect=5.0.4.0
IBM API Connect=5.0.5.0
IBM API Connect=5.0.6.0
IBM API Connect=5.0.6.1
IBM API Connect=5.0.6.2
IBM API Connect=5.0.6.3
IBM API Connect=5.0.6.4
IBM API Connect=5.0.7.0
IBM API Connect=5.0.7.1
IBM API Connect=5.0.7.2
Remediation
Patch Available
Event History
Sep 25, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-1555?
CVE-2017-1555 has a moderate severity rating, indicating that it poses a noteworthy security risk.
2
How do I fix CVE-2017-1555?
To mitigate CVE-2017-1555, upgrade to a version of IBM API Connect that is above 5.0.7.2.
3
Who is affected by CVE-2017-1555?
CVE-2017-1555 affects IBM API Connect versions 5.0.0.0 through 5.0.7.2.
4
What type of access does CVE-2017-1555 exploit?
CVE-2017-1555 allows an authenticated user to generate an API token without being subscribed to the application plan.
5
Can CVE-2017-1555 be exploited remotely?
CVE-2017-1555 requires authenticated access, which means it cannot be exploited remotely without valid user credentials.