IBM API Connect up to V2018.4.1.1 Access Token Log log file

Summaryinfo

A vulnerability was found in IBM API Connect up to V2018.4.1.1. It has been rated as problematic. Impacted is an unknown function of the component Access Token Handler. Performing a manipulation results in log file (Log). This vulnerability is identified as CVE-2019-4008. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in IBM API Connect up to V2018.4.1.1 (Automation Software). It has been classified as problematic. This affects an unknown function of the component Access Token Handler. The manipulation with an unknown input leads to a log file vulnerability (Log). CWE is classifying the issue as CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. This is going to have an impact on confidentiality. The summary by CVE is:

API Connect V2018.1 through 2018.4.1.1 is impacted by access token leak. Authorization tokens in some URLs can result in the tokens being written to log files. IBM X-Force ID: 155626.

The bug was discovered 02/01/2019. The weakness was released 02/07/2019 (Website). The advisory is shared at exchange.xforce.ibmcloud.com. This vulnerability is uniquely identified as CVE-2019-4008 since 01/03/2019. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/06/2023). It is expected to see the exploit prices for this product increasing in the near future.MITRE ATT&CK project uses the attack technique T1592 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 6 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• IBM

Name

• API Connect

Version

• V2018.4.1.0
• V2018.4.1.1

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion