Certain IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 configurations can result in sensitive information in the URL fragment identifiers. This information can be cached in the intermediate nodes like proxy servers, cdn, logging platforms, etc. An attacker can make use of this information to perform attacks by impersonating a user. IBM X-Force ID: 185510.
References
| Link | Resource |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/185510 | VDB Entry Vendor Advisory |
| https://www.ibm.com/support/pages/node/6410486 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
04 Feb 2021, 22:11
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-200 | |
| CPE | cpe:2.3:a:ibm:api_connect:10.0.1.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:api_connect:10.0.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 3.8
v3 : 4.1 |
| References | (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/185510 - VDB Entry, Vendor Advisory | |
| References | (CONFIRM) https://www.ibm.com/support/pages/node/6410486 - Vendor Advisory |
04 Feb 2021, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Certain IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 configurations can result in sensitive information in the URL fragment identifiers. This information can be cached in the intermediate nodes like proxy servers, cdn, logging platforms, etc. An attacker can make use of this information to perform attacks by impersonating a user. IBM X-Force ID: 185510. |
04 Feb 2021, 18:27
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-02-04 17:15
Updated : 2023-12-10 13:41
NVD link : CVE-2020-4640
Mitre link : CVE-2020-4640
CVE.ORG link : CVE-2020-4640
JSON object : View
Products Affected
ibm
- api_connect
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor