CVE-2019-4202 — OS Command Injection in IBM API Connect

CWE-78 — OS Command Injection4 documents4 sources
Severity
10.0CRITICALNVD
EPSS
3.2%
top 12.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM API Connect
Timeline
PublishedApr 15
Latest updateMay 13

Description

IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitrary code on the server and gain complete access to the system. IBM X-Force ID: 159123.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 3.9 | Impact: 6.0

Affected Packages2 packages

▶NVDibm/api_connect5.0.0.0 — 5.0.8.6
▶CVEListV5ibm/api_connect5.0.0.0, 5.0.8.6+1

🔴Vulnerability Details

3
GHSA
GHSA-56h8-9m42-6287: IBM API Connect 5↗2022-05-13
▶
OSV
thunderbird regression↗2019-12-10
▶
CVEList
CVE-2019-4202: IBM API Connect 5↗2019-04-15
▶
CVE-2019-4202 — OS Command Injection in IBM API Connect | cvebase