Incorrect default permissions in API Gateway and API Manager - #VU77043
Published: June 7, 2023
Vulnerability identifier: #VU77043
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-276
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to incorrect default permissions for the apigw-backup-tool.ini file that stores passwords in clear text. A local user with access to the system can view contents of the file and obtain access credentials.
Affected software
API Gateway
API Manager
API Manager
Remediation
Install updates from vendor's website.
API Gateway - update to May 2023
API Manager - update to May 2023
API Manager - update to May 2023