← Vulnerability feed

Vulnerability record · CVE-2019-4382 · published 25 June 2019

CVE-2019-4382: Ibm api connect cleartext transmission vulnerability

Ibm · Api Connect

IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force ID: 162162.

5.3 CVSS 3.1 Medium EPSS 7.8% · top 5.5% CWE-319 · Cleartext transmission
5.3CVSS 3.1 base score, v2 5.0
7.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force ID: 162162.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/108893 Broken LinkThird Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/162162 VDB EntryVendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10886747 PatchVendor Advisory
http://www.securityfocus.com/bid/108893 Broken LinkThird Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/162162 VDB EntryVendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10886747 PatchVendor Advisory

Track CVE-2019-4382 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2019-4202Ibm api connect os command injection vulnerabilityIBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitra…EPSS 4.2%9.9CVE-2018-1789Ibm api connect server-side request forgery (ssrf) vulnerabilityIBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery atta…EPSS 1.2%9.9CVE-2018-1712Ibm api connect cross-site request forgery vulnerabilityIBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input p…EPSS 0.71%9.8CVE-2026-9074Ibm api connect sql injection vulnerabilityIBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset…EPSS 0.51%9.8CVE-2026-3144Ibm api connect vulnerabilityIBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application befor…EPSS 0.41%9.8CVE-2025-13915Ibm api connect vulnerabilityIBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized acce…EPSS 9.0%9.8CVE-2021-29772Ibm api connect code injection vulnerabilityIBM API Connect 5.0.0.0 through 5.0.8.11 could allow a user to potentially inject code due to unsanitized user input. IBM X-Force ID: 202774.EPSS 0.92%9.8CVE-2019-4203Ibm api connect server-side request forgery (ssrf) vulnerabilityIBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from the host OS and potentially …EPSS 1.7%

Source: NIST National Vulnerability Database (record CVE-2019-4382), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.