CVE-2017-1161

IBM API Connect 5.0.6.0 could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of URLs for the Developer Portal. By crafting a malicious URL, an attacker could exploit this vulnerability to execute arbitrary commands on the system with the privileges of the www-data user. IBM X-Force ID: 122956.

Score

CVSS 3.0 7.3 High

Status

Modified - psirt@us.ibm.com

Published

2017-04-17

Last modified

2024-08-05

Weaknesses

CWE-20

Affected products

• Api Connect (Ibm)
• Api Connect (Ibm Corporation)

References

• http://www.ibm.com/support/docview.wss?uid=swg22000316
• http://www.securityfocus.com/bid/97665