CVE-2023-28522 : IBM API Connect V10 could allow an authenticated user to perform actions that th

IBM API Connect V10 could allow an authenticated user to perform actions that they should not have access to. IBM X-Force ID: 250585.

Published 2023-05-12 02:15:09

Updated 2023-05-22 14:51:39

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2023-28522

IBM » Api Connect
Versions from including (>=) 10.0.0.0 and before (<) 10.0.1.11
cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*
Matching versions
IBM » Api Connect
Versions from including (>=) 10.0.2.0 and before (<) 10.0.5.2
cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 38 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	2.8	1.4	IBM Corporation
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Assigned by: nvd@nist.gov (Primary)

https://exchange.xforce.ibmcloud.com/vulnerabilities/250585

IBM API Connect improper access control CVE-2023-28522 Vulnerability Report
VDB Entry;Vendor Advisory
https://www.ibm.com/support/pages/node/6965612

Security Bulletin: IBM API Connect is impacted by an improper access control vulnerability (CVE-2023-28522)
Patch;Vendor Advisory

Jump to