CVE-2020-4828

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. IBM X-Force ID: 189842.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
IBM	API Connect	2018.4.1.0; 2018.4.1.13; 10.0.0.0; 10.0.1.0

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/189842VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6410498Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/189842VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6410498Vendor Advisory

Timeline

Published: Feb 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-48297.8IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in the ksu user command to gain root privileges. IBM X-Fo CVE-2020-48317.5IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h CVE-2020-48325.5IBM PowerHA 7.2 could allow a local attacker to obtain sensitive information from temporary directories after a discovery failure occurs. IB CVE-2020-48385.4IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary Ja CVE-2020-48394.9IBM Host firmware for LC-class Systems is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A remote privileg CVE-2020-48406.1IBM Security Secret Server 10.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a vi CVE-2020-48415.9IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP CVE-2020-48424.9IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is ret CVE-2020-48434.3IBM Security Secret Server 10.6 stores potentially sensitive information in config files that could be read by an authenticated user. IBM X-CVE-2020-48455.4IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J CVE-2020-48462.7IBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical err CVE-2020-48485.4IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 could allow an authenticated user to initiate a plugin or compare process resources