CVE-2018-1716

Опубликовано: 27 сент. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 147164.

Ссылки

http://www.securitytracker.com/id/1041754
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/147164
VDB Entry
Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10729323
Patch
Vendor Advisory
http://www.securitytracker.com/id/1041754
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/147164
VDB Entry
Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10729323
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:websphere_portal:7.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf002:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf003:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf004:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf005:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf006:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf007:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf008:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf009:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf010:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf011:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf012:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf013:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf014:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf015:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf016:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf017:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf018:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf019:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.1:cf020:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf011:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf012:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf013:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf014:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf015:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf016:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf017:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf018:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf019:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf020:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf021:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf022:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf023:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf024:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf025:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf026:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf027:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf028:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf029:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:7.0.0.2:cf030:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.0:cf01:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.0:cf02:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.0:cf03:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.0:cf04:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.0:cf05:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf04:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf05:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf06:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf07:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf08:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf09:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf10:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf11:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf12:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf13:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf14:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf15:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf16:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf17:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf18:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf19:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf20:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf21:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf22:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.0.0.1:cf23:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf01:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf02:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf03:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf04:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf05:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf06:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf07:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf08:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf09:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf10:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf11:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf12:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf13:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf14:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:8.5.0.0:cf15:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:9.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:9.0.0.0:cf14:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_portal:9.0.0.0:cf15:*:*:*:*:*:*

EPSS

Процентиль: 45%

0.00226

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-q68v-wp7g-96w4

CVSS3: 6.1

github

больше 3 лет назад

BDU:2018-01552

CVSS3: 6.1

fstec

больше 7 лет назад

Уязвимость программного средства IBM WebSphere Portal, существующая из-за непринятия мер по защите структуры веб-страницы, позволяющая нарушителю раскрыть учетные данные в рамках доверенного сеанса

EPSS

Процентиль: 45%

0.00226

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79