CVE-2017-1555

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM API Connect 5.0.0.0 through 5.0.7.2 could allow an authenticated user to generate an API token when not subscribed to the application plan. IBM X-Force ID: 131545.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
IBM	API Connect	5.0.1.0; 5.0.0.0; 5.0.0.1; 5.0.2.0; 5.0.5.0; 5.0.6.0; 5.0.6.1; 5.0.6.2; 5.0.7.0; 5.0.7.1; 5.0.3.0; 5.0.4.0; 5.0; 5.0.7.2

References

http://www.ibm.com/support/docview.wss?uid=swg22008588Patch, Vendor Advisory
http://www.securityfocus.com/bid/100973Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/131545VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22008588Patch, Vendor Advisory
http://www.securityfocus.com/bid/100973Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/131545VDB Entry, Vendor Advisory

Timeline

Published: Sep 25, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-155508.8An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and CVE-2017-15566.5IBM API Connect 5.0.7.0 through 5.0.7.2 is vulnerable to a regular expression attack that could allow an authenticated attacker to use a reg CVE-2017-155658.8In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF docume CVE-2017-155667.8Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, al CVE-2017-155677.8The certificate import component in IDEMIA (formerly Morpho) MorphoSmart 1300 Series (aka MSO 1300 Series) devices allows local users to obt CVE-2017-155686.1In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application_helper.rb via a multi-value field CVE-2017-155696.1In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field wit CVE-2017-15574.3IBM WebSphere MQ 8.0 and 9.0 could allow an authenticated user with authority to send a specially crafted request that could cause a channel CVE-2017-155706.1In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/_list.html.erb via crafted column data.CVE-2017-155716.1In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/_list.html.erb via crafted column data.CVE-2017-155727.5In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Refer CVE-2017-155736.1In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content.