CVE-2018-1778: Critical severity api connect cli plugins vulnerability
IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication if the AccessToken Model is exposed over a REST API, it is then possible for anyone to create an AccessToken for any User provided they know the userId and can hence get access to the other user’s data / access to their privileges (if the user happens to be an Admin for example). IBM X-Force ID: 148801.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1778?
CVE-2018-1778 is considered a critical vulnerability as it allows attackers to bypass authentication and gain unauthorized access to user accounts.
How do I fix CVE-2018-1778?
To fix CVE-2018-1778, you should upgrade to a patched version of IBM API Connect that resolves the authentication bypass issue.
What impact does CVE-2018-1778 have on affected systems?
The impact of CVE-2018-1778 includes potential unauthorized access to sensitive user information and increased risk of account compromise.
Which versions of IBM API Connect are affected by CVE-2018-1778?
CVE-2018-1778 affects IBM API Connect versions 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4.
Is it safe to use IBM API Connect if I'm on a vulnerable version related to CVE-2018-1778?
No, it is not safe to use vulnerable versions of IBM API Connect until they have been updated to a version that addresses CVE-2018-1778.