IBM API Connectの更新で脆弱性30件以上、修正版あり
Summary
IBM API Connectの10.0.8系と12.1系に、認証後にコード実行などを許すCVSS v3が9.9の脆弱性12件が公表され、同じ更新で少なくとも30件が修正されました。管理者は修正版へ更新し、アカウントと到達範囲も見直してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
IBM API Connectの10.0.8系と12.1系に、認証後にコード実行などを許すCVSS v3が9.9の脆弱性12件が公表され、同じ更新で少なくとも30件が修正されました。管理者は修正版へ更新し、アカウントと到達範囲も見直してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| IBMAPI Connect |
12.1.0.0 – 12.1.1.2→ Not listed 10.0.8.0 – 10.0.8.12→ Not listed |
Not listed Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions due to a path traversal vulnerability.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- patch psirt@us.ibm.com
- patch psirt@us.ibm.com
- web nvd.nist.gov
- web github.com