Multiple Vulnerabilities in IBM API Connect

Summary

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to impersonate another party.

Remediation

1. Inventory every IBM API Connect deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Patchhttps://www.ibm.com/support/pages/node/7295635
• Patchhttps://www.ibm.com/support/pages/node/7295637