CVE-2020-4640 — Sensitive Information Exposure in IBM API Connect

CWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
4.1MEDIUMNVD
EPSS
0.1%
top 77.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM API Connect
Timeline
PublishedFeb 4
Latest updateMay 24

Description

Certain IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 configurations can result in sensitive information in the URL fragment identifiers. This information can be cached in the intermediate nodes like proxy servers, cdn, logging platforms, etc. An attacker can make use of this information to perform attacks by impersonating a user. IBM X-Force ID: 185510.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:NExploitability: 1.5 | Impact: 2.5

Affected Packages2 packages

▶NVDibm/api_connect2018.4.1.0 — 2018.4.1.13+2
▶CVEListV5ibm/api_connect4 versions+3

🔴Vulnerability Details

2
GHSA
GHSA-4j45-pxr4-w4g4: Certain IBM API Connect 10↗2022-05-24
▶
CVEList
CVE-2020-4640: Certain IBM API Connect 10↗2021-02-04
▶
CVE-2020-4640 — Sensitive Information Exposure in IBM | cvebase