CVE-2020-4640 Information disclosure in API Connect
Sensitive data in URL fragments can be cached by intermediaries, allowing attackers to impersonate users and access protected information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-4640?
CVE-2020-4640 is a low-severity vulnerability in Ibm Api Connect, published on 4 Feb 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Certain IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 configurations can result in sensitive information in the URL fragment identifiers. This information can be cached in the intermediate nodes like proxy servers, cdn, logging platforms, etc. An attacker can make use of this information to perform attacks by impersonating a user. IBM X-Force ID: 185510.
Weakness: CWE-200
Which versions are affected by CVE-2020-4640?
It affects 1 product.
Products include Ibm Api Connect.
How do I fix CVE-2020-4640?
No fix has been published for CVE-2020-4640 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-4640 being exploited?
There is no known exploitation of CVE-2020-4640 in the wild and no public exploit code.
Other vulnerabilities in Ibm Api Connect
Sources
Also known as GHSA-4j45-pxr4-w4g4.