IBM API Connect CVE-2018-1546 Missing HSTS Vulnerability Advisory

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: IBM API Connect is affected by a Missing HTTP Strict Transport Security vulnerability (CVE-2018-1546). 2. Vulnerability Description: - IBM API Connect may allow remote attackers to obtain sensitive information by failing to properly enable HTTP Strict Transport Security. - Attackers can exploit this vulnerability to obtain sensitive information via man-in-the-middle attacks. 3. Vulnerability Details: - CVEID: CVE-2018-1546 - Description: As above. - CVSS Base Score: 5.9 - CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/142650 for current score. - CVSS Environmental Score: Not defined - CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) 4. Affected Products and Versions: - IBM API Connect - Version Range: 5.0.0.0–5.0.8.3 5. Remediation: - IBM API Connect V5.0.8.4 has been fixed. - Management server is affected. - Access the following link and locate the "APIConnect_Management" package: https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect 6. Workarounds and Mitigations: - None 7. Notifications for Future Security Advisories: - Subscribe to My Notifications to receive important product support alerts. 8. References: - Complete CVSS v3 Guide - Online Calculator v3 9. Related Information: - IBM Security Engineering Website - IBM Product Security Incident Response Blog 10. Change History: - July 2, 2018: Original document published 11. Disclaimer: - Refer to the IBM Security Bulletin Disclaimer for details on responsibility for assessing the impact of security vulnerabilities on your environment. This information provides a detailed description of the vulnerability, affected products and versions, remediation steps, and how to receive notifications for future security advisories.

Goal Reached Thanks to every supporter — we hit 100%!

IBM API Connect CVE-2018-1546 Missing HSTS Vulnerability Advisory