CVE-2020-4638: High severity api connect cli plugins vulnerability
IBM API Connect's API Manager 2018.4.1.0 through 2018.4.1.12 is vulnerable to privilege escalation. An invitee to an API Provider organization can escalate privileges by manipulating the invitation link. IBM X-Force ID: 185508.
Other sources
IBM API Connect's API Manager is vulnerable to privilege escalation. An invitee to an API Provider organization can escalate privileges by manipulating the invitation link.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this security issue?
The vulnerability ID is CVE-2020-4638.
What is the severity level of CVE-2020-4638?
The severity level of CVE-2020-4638 is high (7.2).
Which IBM API Connect versions are affected by this vulnerability?
IBM API Connect versions V2018.4.1.0 through V2018.4.1.12 and V10.0.0 are affected by this vulnerability.
How can an invitee to an API Provider organization manipulate the invitation link?
By manipulating the invitation link, an invitee can escalate privileges in IBM API Connect's API Manager 2018.4.1.0 through 2018.4.1.12.
How can the vulnerability be fixed?
The vulnerability can be fixed by applying the available patches provided by IBM. Please refer to the following links for patch information: [IBM API Connect 2018.4.1.0-2018.4.1.12](http://www.ibm.com/support/fixcentral/swg/quickorder?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=2018.4.1.12&platform=All&function=all&source=fc) and [IBM API Connect V10.0.0](https://www.ibm.com/support/pages/node/6339249).