CVE-2017-1161

IBM API Connect 5.0.6.0 could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of URLs for the Developer Portal. By crafting a malicious URL, an attacker could exploit this vulnerability to execute arbitrary commands on the system with the privileges of the www-data user. IBM X-Force ID: 122956.

CVSS v3 7.3 HIGH
CVSS v2.0 7.5 HIGH

7.3^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.ibm.com/support/docview.wss?uid=swg22000316	Vendor Advisory
http://www.securityfocus.com/bid/97665	Third Party Advisory VDB Entry
http://www.ibm.com/support/docview.wss?uid=swg22000316	Vendor Advisory
http://www.securityfocus.com/bid/97665	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:ibm:api_connect:5.0.6.0:*:*:*:*:*:*:*

History

21 Nov 2024, 03:21

Type	Values Removed	Values Added
References	~~() http://www.ibm.com/support/docview.wss?uid=swg22000316 - Vendor Advisory~~	() http://www.ibm.com/support/docview.wss?uid=swg22000316 - Vendor Advisory
References	~~() http://www.securityfocus.com/bid/97665 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/97665 - Third Party Advisory, VDB Entry

Information

Published : 2017-04-17 21:59

Updated : 2024-11-21 03:21

NVD link : CVE-2017-1161

Mitre link : CVE-2017-1161

CVE.ORG link : CVE-2017-1161

JSON object : View

Products Affected

ibm

api_connect

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2017-1161", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "published": "2017-04-17T21:59:00.327", "references": [{"url": "http://www.ibm.com/support/docview.wss?uid=swg22000316", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/97665", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@us.ibm.com"}, {"url": "http://www.ibm.com/support/docview.wss?uid=swg22000316", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/97665", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "IBM API Connect 5.0.6.0 could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of URLs for the Developer Portal. By crafting a malicious URL, an attacker could exploit this vulnerability to execute arbitrary commands on the system with the privileges of the www-data user. IBM X-Force ID: 122956."}, {"lang": "es", "value": "IBM API Connect 5.0.6.0 podr\u00eda permitir a un atacante remoto ejecutar comandos arbitrarios en el sistema, causados por una validaci\u00f3n incorrecta de las URL del Developer Portal. Al crear URLs malintencionadas, un atacante podr\u00eda explotar esta vulnerabilidad para ejecutar comandos arbitrarios en el sistema con los privilegios del usuario de datos www-data user. IBM X-Force ID: 122956."}], "lastModified": "2024-11-21T03:21:25.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:api_connect:5.0.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D8AD67C-0221-4EF1-B0A2-C13CEE62D27F"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}