CVE-2015-0149

IBM API Management 3.0 - Authenticated Unauthorized API Access

Title source: llm
STIX 2.1

Description

The developer portal in IBM API Management 3.0 before 3.0.4.1 does not properly restrict access to the public and private APIs, which allows remote authenticated users to obtain sensitive information or modify data via unspecified API calls.

References (2)

Core 2
Core References
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1LI78430
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21696693

Scores

EPSS 0.0093
EPSS Percentile 56.9%

Details

CWE
CWE-264
Status published
Products (5)
ibm/api_management 3.0.0.0
ibm/api_management 3.0.2.0
ibm/api_management 3.0.2.1
ibm/api_management 3.0.3.0
ibm/api_management 3.0.4.0
Published Mar 18, 2015
Tracked Since Feb 18, 2026