CVE-2020-4828: Input Validation

Q: What is the vulnerability ID for this issue?

The vulnerability ID is CVE-2020-4828.

Q: What is the severity of CVE-2020-4828?

The severity of CVE-2020-4828 is medium with a CVSS score of 6.5.

Q: What is the affected software?

The affected software includes IBM API Connect versions 10.0.0.0 through 10.0.1.0, and versions 2018.4.1.0 through 2018.4.1.13.

Q: How does CVE-2020-4828 affect IBM API Connect?

CVE-2020-4828 allows web cache poisoning in IBM API Connect due to improper input validation by modifying HTTP request headers.

Q: Is there a reference link for more information on CVE-2020-4828?

Yes, you can find more information on CVE-2020-4828 at the IBM X-Force ID: 189842 and the IBM support pages.

Published Feb 2, 2021

Updated

IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. IBM X-Force ID: 189842.

Other sources

IBM API Connect is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers.

— IBM

Affected Software

5 affected components

IBM API Connect V2018.4.1.0-2018.4.1.13<=undefined

IBM API Connect V10.0.1.0<=undefined

IBM API Connect>=2018.4.1.0<=2018.4.1.13

IBM API Connect=10.0.0.0

IBM API Connect=10.0.1.0

Event History

Feb 2, 2021

CVE Published

via IBM·12:00 AM

Feb 4, 2021

CVE Published

via MITRE·04:55 PM

Data Sourced

via MITRE·04:55 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-6410498

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID is CVE-2020-4828.

What is the severity of CVE-2020-4828?