IBM API Connect 5.0.7/5.0.8 Parameter information disclosure

Summaryinfo

A vulnerability has been found in IBM API Connect 5.0.7/5.0.8 and classified as problematic. The impacted element is an unknown function. The manipulation as part of Parameter leads to information disclosure. This vulnerability is referenced as CVE-2017-1785. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in IBM API Connect 5.0.7/5.0.8 (Automation Software) and classified as problematic. This issue affects an unknown part. The manipulation as part of a Parameter leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

IBM API Connect 5.0.7 and 5.0.8 could allow an authenticated remote user to modify query parameters to obtain sensitive information. IBM X-Force ID: 136859.

The bug was discovered 02/02/2018. The weakness was published 02/07/2018 (Website). It is possible to read the advisory at ibm.com. The identification of this vulnerability is CVE-2017-1785 since 11/30/2016. The exploitation is known to be easy. The attack may be initiated remotely. A simple authentication is necessary for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/02/2021). It is expected to see the exploit prices for this product increasing in the near future.The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 5 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• IBM

Name

• API Connect

Version

• 5.0.7
• 5.0.8

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion