CVE-2023-28522: IBM API Connect improper access control
Published Mar 22, 2023
·Updated
IBM API Connect V10 could allow an authenticated user to perform actions that they should not have access to.
Affected Software
3 affected components
IBM API Connect<=V10.x
IBM API Connect>=10.0.0.0<10.0.1.11
IBM API Connect>=10.0.2.0<10.0.5.2
Remediation
Patch Available
Event History
Mar 22, 2023
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionSeverityAffected Software
May 12, 2023
CVE Published
via MITRE·01:22 AM
Data Sourced
via MITRE·01:22 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2023-28522?
CVE-2023-28522 is a vulnerability in IBM API Connect V10 that allows an authenticated user to perform unauthorized actions.
2
How severe is CVE-2023-28522?
CVE-2023-28522 has a severity rating of 8.8 out of 10, which is categorized as high.
3
What is the affected software?
The affected software is IBM API Connect V10 with versions between 10.0.0.0 and 10.0.1.11, and between 10.0.2.0 and 10.0.5.2.
4
How can an authenticated user exploit CVE-2023-28522?
An authenticated user can exploit CVE-2023-28522 by performing actions that they should not have access to.
5
Is there a fix available for CVE-2023-28522?
Yes, IBM has provided a fix for CVE-2023-28522. Please refer to the IBM support page for more information.