medium4.3
CVE-2021-20440
IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient.
Impact
IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient. An attacker who is a valid user in the user registry used by API Manager can use a stolen invitation link and register themselves as a member of an API provider organization. IBM X-Force ID: 196536.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ibm | Api Connect | from 2018.4.1.0 through 2018.4.1.13 Version 10.0.0.0 |