CVE-2018-1973

IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level access to give themselves full 'Administrator'…

High7.2EPSS 2.3%

Published: 20 Dec 2018
Updated: 16 Sept 2024
Reserved: 13 Dec 2017
Assigned by: ibm

Description

IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level access to give themselves full 'Administrator' level access through the members functionality. IBM X-Force ID: 153914.

Timeline

2017
13 Dec 2017
13 Dec 2017
ID reserved
By ibm
2018
20 Dec 201812 months later
20 Dec 2018· 12 months later
Published
2024
16 Sept 20246 years later
16 Sept 2024· 6 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2018-1973, by who scored it
Scored by	CVSS	Score	Vector
ibmCNA (assigner)	3.0	High7.2	CVSS:3.0/A:H/AC:L/AV:N/C:H/I:H/PR:H/S:U/UI:N/E:U/RC:C/RL:O
NVDNVD · Modified	3.0	High7.2	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 2.3% · top 17% of all CVEs (8 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.

Weakness

Gain Privileges
CWE-269 (opens in a new tab)All about CWE-269 and its CVEs

Affected products

IBM · API Connect
- affected 5.0.0.0
- affected 5.0.8.4

References (3)

https://www.ibm.com/support/docview.wss?uid=ibm10788339 (opens in a new tab)x_refsource_CONFIRMx_transferred
106281 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
ibm-api-cve20181973-priv-escalation(153914) (opens in a new tab)vdb-entryx_refsource_XFx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2018-1973](https://cveledger.app/badge/CVE-2018-1973.svg)](https://cveledger.app/cve/CVE-2018-1973)

Record last updated 16 Sept 2024, 17:39 UTC.