CVE-2018-1660

Опубликовано: 27 сент. 2018

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-force ID: 144886.

Ссылки

http://www.securityfocus.com/bid/105446
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041755
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/144886
VDB Entry
Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10715923
Patch
Vendor Advisory
http://www.securityfocus.com/bid/105446
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041755
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/144886
VDB Entry
Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10715923
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:websphere_portal:7.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:-:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf002:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf003:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf004:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf005:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf006:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf007:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf008:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf009:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf010:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf011:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf012:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf013:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf014:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf015:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf016:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf017:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf018:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf019:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf020:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:-:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf011:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf012:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf013:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf014:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf015:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf016:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf017:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf018:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf019:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf020:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf021:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf022:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf023:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf024:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf025:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf026:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf027:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf028:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf029:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf030:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.0:-:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.0:cf01:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.0:cf02:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.0:cf03:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.0:cf04:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.0:cf05:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.0:cf06:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:-:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf04:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf05:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf06:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf07:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf08:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf09:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf10:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf11:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf12:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf13:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf14:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf15:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf16:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf17:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf18:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf19:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf20:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf21:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf22:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf23:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:-:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf01:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf02:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf03:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf04:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf05:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf06:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf07:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf08:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf09:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf10:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf11:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf12:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf13:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf14:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf15:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:9.0.0.0:-:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:9.0.0.0:cf14:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:9.0.0.0:cf15:*:*:*:*:*:*

EPSS

Процентиль: 60%

0.00403

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-jwhf-qmr4-x294

CVSS3: 5.4

github

больше 3 лет назад

BDU:2018-01553

CVSS3: 5.4

fstec

больше 7 лет назад

Уязвимость программного средства IBM WebSphere Portal, существующая из-за непринятия мер по защите структуры веб-страницы, позволяющая нарушителю раскрыть учетные данные в рамках доверенного сеанса

EPSS

Процентиль: 60%

0.00403

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79