CVE-2018-1778

IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication if the AccessToken Model is exposed over a REST API, it is then possible for anyone to create an AccessToken for any User provided they know the userId and can hence get access to the other userÃ¢ÂÂs data / access to their privileges (if the user happens to be an Admin for example). IBM X-Force ID: 148801.

CVSS v3 8.1 HIGH
CVSS v2.0 9.3 HIGH

8.1^/10

CVSS v3 : HIGH

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.ibm.com/support/docview.wss?uid=ibm10733883	Patch Vendor Advisory
http://www.securityfocus.com/bid/106313	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/148801	VDB Entry Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:api_connect::::::::
	cpe:2.3:a:ibm:api_connect::::::::

History

No history.

Information

Published : 2018-12-20 14:29

Updated : 2023-12-10 12:44

NVD link : CVE-2018-1778

Mitre link : CVE-2018-1778

CVE.ORG link : CVE-2018-1778

JSON object : View

Products Affected

ibm

api_connect

CWE

CWE-287

Improper Authentication

{"id": "CVE-2018-1778", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.2}]}, "published": "2018-12-20T14:29:00.447", "references": [{"url": "http://www.ibm.com/support/docview.wss?uid=ibm10733883", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/106313", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/148801", "tags": ["VDB Entry", "Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication if the AccessToken Model is exposed over a REST API, it is then possible for anyone to create an AccessToken for any User provided they know the userId and can hence get access to the other userÃ¢ÂÂs data / access to their privileges (if the user happens to be an Admin for example). IBM X-Force ID: 148801."}, {"lang": "es", "value": "IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0 y 5.0.8.4) podr\u00eda permitir que un atacante omita la autenticaci\u00f3n si se expone el modelo AccessToken en una API REST. En este caso, es posible que cualquiera cree un AccessToken para cualquier usuario, siempre y cuando conozcan el userId y puedan, por lo tanto, acceder a los datos/privilegios de los otros usuarios (si el usuario resulta ser un administrador, por ejemplo). IBM X-Force ID: 148801."}], "lastModified": "2019-10-09T23:39:04.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2EE04F67-2883-4840-9574-7363C3CD618E", "versionEndIncluding": "5.0.8.4", "versionStartIncluding": "5.0.8.0"}, {"criteria": "cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C567025-9080-4C12-9F27-005B2A7F5149", "versionEndIncluding": "2018.4.1.0", "versionStartIncluding": "2018.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}