« Volver al listado

CVE-2017-1328

Estado: ModificadaMedia (5.3)—

IBM API Connect 5.0.0.0 - 5.0.6.0 could allow a remote attacker to bypass security restrictions of the api, caused by improper handling of security policy. By crafting a suitable request, an attacker could exploit this vulnerability to bypass security and use the vulnerable API. IBM X-Force ID: 126230.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — API Connect

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-1328",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": true,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "vendor": "IBM",
          "product": "API Connect",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.1.0"
            },
            {
              "status": "affected",
              "version": "5.0.0.0"
            },
            {
              "status": "affected",
              "version": "5.0.2.0"
            },
            {
              "status": "affected",
              "version": "5.0.5.0"
            },
            {
              "status": "affected",
              "version": "5.0.6.0"
            },
            {
              "status": "affected",
              "version": "5.0.3.0"
            },
            {
              "status": "affected",
              "version": "5.0.4.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-06-27T16:29:00.480",
  "references": [
    {
      "url": "http://www.ibm.com/support/docview.wss?uid=swg22003867",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/99267",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/126230",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www.ibm.com/support/docview.wss?uid=swg22003867",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/99267",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/126230",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM API Connect 5.0.0.0 - 5.0.6.0 could allow a remote attacker to bypass security restrictions of the api, caused by improper handling of security policy. By crafting a suitable request, an attacker could exploit this vulnerability to bypass security and use the vulnerable API. IBM X-Force ID: 126230."
    },
    {
      "lang": "es",
      "value": "IBM API Connect 5.0.0.0 - 5.0.6.0 podría permitir que un atacante remoto omita las restricciones de seguridad de la API, provocado por la gestión incorrecta de la política de seguridad. Al manipular una petición adecuada, un atacante podría explotar esta vulnerabilidad para omitir la seguridad y emplear la API vulnerable. IBM X-Force ID: 126230."
    }
  ],
  "lastModified": "2026-06-17T01:14:15.870",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:api_connect:5.0.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B43F8D4-A60E-4C56-B868-8616958A0B74"
            },
            {
              "criteria": "cpe:2.3:a:ibm:api_connect:5.0.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39A4F3B4-A3D8-4281-BBB1-8B95297657F1"
            },
            {
              "criteria": "cpe:2.3:a:ibm:api_connect:5.0.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4049722A-338F-49FA-A9B2-2A432F04D2A8"
            },
            {
              "criteria": "cpe:2.3:a:ibm:api_connect:5.0.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C12F86C-FBDF-4231-B4EA-4279FC730088"
            },
            {
              "criteria": "cpe:2.3:a:ibm:api_connect:5.0.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BBC9AEC-CD8B-4F2A-99A7-469B93107B9F"
            },
            {
              "criteria": "cpe:2.3:a:ibm:api_connect:5.0.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBB03CE4-C3EE-41E9-9321-9AB9829FDB5D"
            },
            {
              "criteria": "cpe:2.3:a:ibm:api_connect:5.0.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7B9AC88-C53D-4810-B21E-7A836524859B"
            },
            {
              "criteria": "cpe:2.3:a:ibm:api_connect:5.0.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D8AD67C-0221-4EF1-B0A2-C13CEE62D27F"
            },
            {
              "criteria": "cpe:2.3:a:ibm:api_connect:5.0.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "61864755-C7B6-416C-9D3E-334AB3D94825"
            },
            {
              "criteria": "cpe:2.3:a:ibm:api_connect:5.0.6.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FCB9030-50A4-4B9B-8457-9DB9E13B3211"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}