IBME1E23385784EE6A273817DDEF72E5E6A1F520AEA9AC6AD22B2628C3BF9B94E85Security Bulletin: IBM API Connect is vulnerable to cookie forgery via PHP (CVE-2020-7070)
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.002 Low
EPSS
Percentile
58.4%
Summary
IBM API Connect has addressed the following vulnerability.
Vulnerability Details
CVEID:CVE-2020-7070
**DESCRIPTION:**PHP could allow a remote attacker to bypass security restrictions, caused by the lack of validation/integrity check security for HTTP cookie. By using a specially-crafted HTTP cookie, an attacker could exploit this vulnerability to forge a secure cookie.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/189237 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM API Connect | V5.0.0.0-5.0.8.10 |
| IBM API Connect | V10.0.1.0 |
| IBM API Connect | V2018.4.1.0-2018.4.1.12 |
Remediation/Fixes
| Affected Product | Addressed in VRMF | APAR | Remediation/First Fix |
|---|---|---|---|
| IBM API Connect V5.0.0.0-5.0.8.10 | 5.0.8.10 iFix | LI81915 |
Addressed in IBM API Connect 5.0.8.10 iFix published on or after December 16, 2020.
Developer Portal is impacted.
Follow this link and find the “Portal” package.
http://www.ibm.com/support/fixcentral/swg/quickorder
IBM API Connect
V2018.4.1.0-2018.4.1.13
| 2018.4.1.15|
LI81915
|
Addressed in IBM API Connect V2018.4.1.15.
Developer Portal is impacted.
Follow this link and find the “Portal” package.
http://www.ibm.com/support/fixcentral/swg/quickorder
IBM API Connect
V10.0.1.0
| 10.0.1.1|
LI81915
|
Addressed in IBM API Connect V10.0.1.1
Developer Portal is impacted.
Follow this link and find the “Portal” package.
http://www.ibm.com/support/fixcentral/swg/quickorder
Workarounds and Mitigations
None
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.002 Low
EPSS
Percentile
58.4%