CVE-2021-20440

3 documents3 sources
Severity
4.3MEDIUM
EPSS
0.2%
top 60.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM API Connect
Timeline
PublishedMar 15
Latest updateMay 24

Description

IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient. An attacker who is a valid user in the user registry used by API Manager can use a stolen invitation link and register themselves as a member of an API provider organization. IBM X-Force ID: 196536.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDibm/api_connect2018.4.1.0 — 2018.4.1.13+1
▶CVEListV5ibm/api_connect10.0.0.0, 2018.4.1.0, 2018.4.1.13+2

🔴Vulnerability Details

2
GHSA
GHSA-6f4h-wv9p-43cg: IBM API Connect 10↗2022-05-24
▶
CVEList
CVE-2021-20440: IBM API Connect 10↗2021-03-15
▶
CVE-2021-20440 (MEDIUM CVSS 4.3) | IBM API Connect 10.0.0.0 | cvebase.io