CVE-2018-1532 Information disclosure in API Connect

Medium 4.3 Published 31 May 2018 Updated 16 Sep 2024

IBM API Connect fails to rotate session IDs, allowing attackers to obtain session identifiers for potential system compromise.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-1532?

CVE-2018-1532 is a medium-severity vulnerability in Ibm Api Connect, published on 31 May 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM API Connect 5.0.0.0 through 5.0.8.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. IBM X-Force ID: 142430.

Weakness: CWE-200

Which versions are affected by CVE-2018-1532?

It affects 1 product.

Products include Ibm Api Connect.

How do I fix CVE-2018-1532?

No fix has been published for CVE-2018-1532 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-1532 being exploited?

There is no known exploitation of CVE-2018-1532 in the wild and no public exploit code.

All Ibm Api Connect vulnerabilities

Sources

Also known as GHSA-2924-xwpv-8gcj.