CVE-2017-1386 describes a vulnerability in IBM API Connect 5.0.0.0 and IBM API Management that allows users to bypass password policy restrictions. This flaw could enable the creation of non-compliant passwords, which are then susceptible to interception and decryption via man-in-the-middle attacks, leading to potential compromise of sensitive information. The vulnerability has a CVSSv3 score of 5.9 (Medium), indicating a network-based attack with high complexity, requiring no user interaction, and resulting in high confidentiality impact. While the integrity and availability impacts are none, the potential for sensitive data exposure is significant. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness or attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
5.0.0.0CPE matchmatch criteria | cpe:2.3:a:ibm:api_connect:5.0.0.0:*:*:*:*:*:*:* | ||
5.0.0.1CPE matchmatch criteria | cpe:2.3:a:ibm:api_connect:5.0.0.1:*:*:*:*:*:*:* | ||
5.0.1.0CPE matchmatch criteria | cpe:2.3:a:ibm:api_connect:5.0.1.0:*:*:*:*:*:*:* | ||
5.0.2.0CPE matchmatch criteria | cpe:2.3:a:ibm:api_connect:5.0.2.0:*:*:*:*:*:*:* | ||
5.0.3.0CPE matchmatch criteria | cpe:2.3:a:ibm:api_connect:5.0.3.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.