← Vulnerability feed

Vulnerability record · CVE-2019-4202 · published 15 April 2019

CVE-2019-4202: Ibm api connect os command injection vulnerability

Ibm · Api Connect

IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitrary code on the server and gain complete access to the system. IBM X-Force ID: 159123.

10.0 CVSS 3.1 Critical EPSS 4.2% · top 9.4% CWE-78 · OS command injection
10.0CVSS 3.1 base score, v2 10.0
4.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitrary code on the server and gain complete access to the system. IBM X-Force ID: 159123.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/107908 Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/159123 VDB EntryVendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10880109 Vendor Advisory
http://www.securityfocus.com/bid/107908 Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/159123 VDB EntryVendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10880109 Vendor Advisory

Track CVE-2019-4202 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2018-1789Ibm api connect server-side request forgery (ssrf) vulnerabilityIBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery atta…EPSS 1.2%9.9CVE-2018-1712Ibm api connect cross-site request forgery vulnerabilityIBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input p…EPSS 0.71%9.8CVE-2026-9074Ibm api connect sql injection vulnerabilityIBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset…EPSS 0.51%9.8CVE-2026-3144Ibm api connect vulnerabilityIBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application befor…EPSS 0.41%9.8CVE-2025-13915Ibm api connect vulnerabilityIBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized acce…EPSS 9.0%9.8CVE-2021-29772Ibm api connect code injection vulnerabilityIBM API Connect 5.0.0.0 through 5.0.8.11 could allow a user to potentially inject code due to unsanitized user input. IBM X-Force ID: 202774.EPSS 0.92%9.8CVE-2019-4203Ibm api connect server-side request forgery (ssrf) vulnerabilityIBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from the host OS and potentially …EPSS 1.7%9.8CVE-2019-4155Ibm api connect vulnerabilityIBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect (…EPSS 2.6%

Source: NIST National Vulnerability Database (record CVE-2019-4202), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.