CVE-2015-0149 The developer portal in IBM API Management 3.0 before 3.0.4.1 does not properly restrict access to the public and private APIs, which allows remote authenticated users to obtain sensitive information....
MediumCVSS 5.5
EPSS 0.93%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The developer portal in IBM API Management 3.0 before 3.0.4.1 does not properly restrict access to the public and private APIs, which allows remote authenticated users to obtain sensitive information or modify data via unspecified API calls.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm api management | = 3.0.0.0 | No fix listed |
| ibm api management | = 3.0.2.0 | No fix listed |
| ibm api management | = 3.0.2.1 | No fix listed |
| ibm api management | = 3.0.3.0 | No fix listed |
| ibm api management | = 3.0.4.0 | No fix listed |
References
- LI78430 vendor-advisory
- www-01.ibm.com patch vendor-advisory