IBM App Connect Enterprise and Operator Clear Text Data Transmission Vulnerability Allowing Interception of Sensitive Information

A vulnerability exists in multiple versions of IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands, where data is transmitted in clear text. This flaw could enable an attacker to intercept and access sensitive information using man-in-the-middle techniques. The issue arises when the App Connect Enterprise Certified Container IntegrationRuntime or IntegrationServer is configured to report metrics to a Prometheus instance within the OpenShift cluster, as these metrics are sent over an unencrypted channel.

Impact

Exploitation of this vulnerability could lead to unauthorized interception and access to sensitive information being transmitted from the App Connect Enterprise components to the Prometheus instance.

Remediation

Users are advised to upgrade to IBM App Connect Enterprise Certified Container Operator version 12.21.0 or higher for Continuous Delivery versions, and version 12.0.21 or higher for Long Term Support versions. Ensure that all DesignerAuthoring, IntegrationServer, and IntegrationRuntime components are at the recommended versions. Documentation on the upgrade process is available on the IBM App Connect support pages.