CVE-2018-1638 — Improper Authentication in IBM API Connect

CWE-287 — Improper Authentication3 documents3 sources
Severity
8.1HIGHNVD
CNA5.9
EPSS
0.2%
top 58.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM API Connect
Timeline
PublishedJul 31
Latest updateMay 13

Description

IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication (TFA) while resetting a user password but enforces it for all other login scenarios. IBM X-Force ID: 144483.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages2 packages

▶NVDibm/api_connect5.0.0.0 — 5.0.8.3
▶CVEListV5ibm/api_connect5.0.0.0-5.0.8.3

🔴Vulnerability Details

2
GHSA
GHSA-cm63-5mv5-74rv: IBM API Connect 5↗2022-05-13
▶
CVEList
CVE-2018-1638: IBM API Connect 5↗2018-07-31
▶
CVE-2018-1638 — Improper Authentication in IBM | cvebase