Multiple vulnerabilities in API Gateway and API Manager
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 12 |
| CVE-ID | CVE-2019-16728 CVE-2023-0286 CVE-2022-4304 CVE-2022-4203 CVE-2023-0215 CVE-2022-4450 CVE-2023-0216 CVE-2023-0217 CVE-2023-0401 |
| CWE-ID | CWE-79 CWE-799 CWE-254 CWE-843 CWE-208 CWE-125 CWE-416 CWE-415 CWE-763 CWE-476 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
API Gateway Server applications / Application servers API Manager Web applications / Other software |
| Vendor | Axway |
Security Bulletin
This security bulletin contains information about 12 vulnerabilities.
1) Cross-site scripting
EUVDB-ID: #VU74266
Risk: Medium
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green]
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in API Manager UI. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall update from vendor's website.
Vulnerable software versionsAPI Gateway: April 2019 - February 2022
API Manager: April 2019 - February 2022
CPE2.3- cpe:2.3:a:axway:api_gateway:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:September 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:September 2020:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Improper control of interaction frequency
EUVDB-ID: #VU74267
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: N/A
CWE-ID:
CWE-799 - Improper Control of Interaction Frequency
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform DoS attack.
The vulnerability exists due to missing limitations on the number of requests sent to the "/register" endpoint of API Manager. A remote attacker can create numerous registrations and perform a denial of service (DoS) attack.
Install update from vendor's website.
Vulnerable software versionsAPI Gateway: April 2019 - February 2022
API Manager: April 2019 - February 2022
CPE2.3- cpe:2.3:a:axway:api_gateway:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:September 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:September 2020:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Security features bypass
EUVDB-ID: #VU74268
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-254 - Security Features
Exploit availability: No
DescriptionThe vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to password policy is not applied at the backend. A remote user can bypass UI restrictions and set weak password for their account.
Install update from vendor's website.
Vulnerable software versionsAPI Gateway: April 2019 - February 2022
API Manager: April 2019 - February 2022
CPE2.3- cpe:2.3:a:axway:api_gateway:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:September 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:September 2020:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Cross-site scripting
EUVDB-ID: #VU22273
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-16728
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code through Mutation XSS in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Note: This vulnerability exists because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element.
MitigationInstall update from vendor's website.
Vulnerable software versionsAPI Gateway: April 2019 - February 2022
API Manager: April 2019 - February 2022
CPE2.3- cpe:2.3:a:axway:api_gateway:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:September 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:September 2020:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Type Confusion
EUVDB-ID: #VU71992
Risk: High
CVSSv4.0: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2023-0286
CWE-ID:
CWE-843 - Type confusion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a type confusion error related to X.400 address processing inside an X.509 GeneralName. A remote attacker can pass specially crafted data to the application, trigger a type confusion error and perform a denial of service (DoS) attack or read memory contents.
In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.
Install update from vendor's website.
Vulnerable software versionsAPI Gateway: April 2019 - February 2022
API Manager: April 2019 - February 2022
CPE2.3- cpe:2.3:a:axway:api_gateway:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:September 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:September 2020:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Information Exposure Through Timing Discrepancy
EUVDB-ID: #VU71993
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-4304
CWE-ID:
CWE-208 - Information Exposure Through Timing Discrepancy
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain sensitive information.
The vulnerability exists due to a timing based side channel exists in the OpenSSL RSA Decryption implementation. A remote attacker can perform a Bleichenbacher style attack and decrypt data sent over the network.
To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE.
Install update from vendor's website.
Vulnerable software versionsAPI Gateway: April 2019 - February 2022
API Manager: April 2019 - February 2022
CPE2.3- cpe:2.3:a:axway:api_gateway:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:September 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:September 2020:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Out-of-bounds read
EUVDB-ID: #VU71994
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-4203
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when performing name constraint checking of the X.509 certificates. A remote attacker can pass a specially crafted X.509 certificate to the affected server, trigger an out-of-bounds read error and read contents of memory on the system.
MitigationInstall update from vendor's website.
Vulnerable software versionsAPI Gateway: April 2019 - February 2022
API Manager: April 2019 - February 2022
CPE2.3- cpe:2.3:a:axway:api_gateway:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:September 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:September 2020:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Use-after-free
EUVDB-ID: #VU71995
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-0215
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error within the BIO_new_NDEF function. A remote attacker can trigger a use-after-free error and perform a denial of service (DoS) attack.
Install update from vendor's website.
Vulnerable software versionsAPI Gateway: April 2019 - February 2022
API Manager: April 2019 - February 2022
CPE2.3- cpe:2.3:a:axway:api_gateway:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:September 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:September 2020:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Double Free
EUVDB-ID: #VU71996
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-4450
CWE-ID:
CWE-415 - Double Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the PEM_read_bio_ex() function. A remote attacker can pass specially crafted PEM file to the application, trigger a double free error and perform a denial of service (DoS) attack.
Install update from vendor's website.
Vulnerable software versionsAPI Gateway: April 2019 - February 2022
API Manager: April 2019 - February 2022
CPE2.3- cpe:2.3:a:axway:api_gateway:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:September 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:September 2020:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Release of invalid pointer or reference
EUVDB-ID: #VU71997
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-0216
CWE-ID:
CWE-763 - Release of invalid pointer or reference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to invalid pointer dereference in d2i_PKCS7 functions. A remote attacker can perform a denial of service (DoS) attack.
Install update from vendor's website.
Vulnerable software versionsAPI Gateway: April 2019 - February 2022
API Manager: April 2019 - February 2022
CPE2.3- cpe:2.3:a:axway:api_gateway:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:September 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:September 2020:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) NULL pointer dereference
EUVDB-ID: #VU71998
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-0217
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error when validating the DSA public key. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
MitigationInstall update from vendor's website.
Vulnerable software versionsAPI Gateway: April 2019 - February 2022
API Manager: April 2019 - February 2022
CPE2.3- cpe:2.3:a:axway:api_gateway:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:September 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:September 2020:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) NULL pointer dereference
EUVDB-ID: #VU71999
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-0401
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error during PKCS7 data verification. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
MitigationInstall update from vendor's website.
Vulnerable software versionsAPI Gateway: April 2019 - February 2022
API Manager: April 2019 - February 2022
CPE2.3- cpe:2.3:a:axway:api_gateway:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_gateway:September 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:April 2019:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:November 2020:*:*:*:*:*:*:*
- cpe:2.3:a:axway:api_manager:September 2020:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
