CVE-2018-1740

CWE-79 — Cross-site Scripting (XSS)5 documents4 sources

Severity

5.4MEDIUM

EPSS

0.2%

top 63.32%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Security Access Manager IBM Security Access Manager Appliance

Timeline

PublishedDec 13

Latest updateMay 13

Description

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148419.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5ibm/security_access_manager_appliance5 versions+4

▶NVDibm/security_access_manager9.0.1.0 — 9.0.5.0

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

GHSA

GHSA-6865-fwr3-4624: IBM Security Access Manager Appliance 9↗2022-05-13

▶

CVEList

CVE-2018-1740: IBM Security Access Manager Appliance 9↗2018-12-13

▶

💥Exploits & PoCs

Exploit-DB

Z-Blog 1.5.1.1740 - Cross-Site Scripting↗2018-04-05

▶

Exploit-DB

Z-Blog 1.5.1.1740 - Full Path Disclosure↗2018-04-05

▶