IBM Security Bulletin: API Connect is affected by a weak two factor authentication vulnerability

Jul 27, 2018 9:01 am EDT

Categorized: Medium Severity

Share this post:

IBM API Connect has addressed the following vulnerability. API Connect user are affected by a TwoFactor (2FA/TFA) bypass while resetting password. Using API Connect version 5.0.8.3 and with Two Factor Authentication enabled on the Developer Portal it is possible to bypass TFA and get full access.

CVE(s): CVE-2018-1638

Affected product(s) and affected version(s):

Affected API Connect	Affected Versions
API Connect	5.0.0.0-5.0.8.3

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: https://www-01.ibm.com/support/docview.wss?uid=ibm10718415
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/144483

from IBM Product Security Incident Response Team https://ift.tt/2vcefar