IBM API Connect Multiple Information Disclosure Vulnerabilities

Bugtraq ID:	108907
Class:	Design Error
CVE:	CVE-2018-2011 CVE-2018-2013
Remote:	Yes
Local:	No
Published:	Jun 12 2019 12:00AM
Updated:	Jun 12 2019 12:00AM
Credit:	IBM
Vulnerable:	IBM API Connect 2018.4.1 IBM API Connect 2018.3.7 IBM API Connect 2018.3.6 IBM API Connect 2018.3.4 IBM API Connect 2018.2.5 IBM API Connect 2018.2.3 IBM API Connect 2018.2 IBM API Connect 2018.1 IBM API Connect 2018.4.1.5 IBM API Connect 2018.4.1.4 IBM API Connect 2018.4.1.3 IBM API Connect 2018.4.1.2 IBM API Connect 2018.4.1.1
Not Vulnerable:	IBM API Connect 2018.4.1.6

IBM API Connect Multiple Information Disclosure Vulnerabilities

IBM API Connect is prone to multiple information-disclosure vulnerabilities.

Remote attackers can exploit these issues to obtain sensitive information that may lead to further attacks.

IBM API Connect 2018.1 through 2018.4.1.5 are vulnerable.

IBM API Connect Multiple Information Disclosure Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM API Connect Multiple Information Disclosure Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM API Connect Multiple Information Disclosure Vulnerabilities

References:

• IBM Homepage (IBM)
  
• Security Bulletin: API Connect V2018 is impacted by sensitive information leak ( (IBM)
  
• Security Bulletin: API Connect V2018 is impacted by software stack information (IBM)