CVE-2018-1926 — Cross-Site Request Forgery in IBM Websphere Application Server

CWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
8.8HIGHNVD
CNA4.3
EPSS
0.2%
top 61.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Websphere Application Server
Timeline
PublishedDec 12
Latest updateMay 13

Description

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious URL, a remote attacker could send a specially-crafted request. An attacker could exploit this vulnerability to perform CSRF attack and update available applications. IBM X-Force ID: 152992.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDibm/websphere_application_server7.0.0.0 — 7.0.0.45+3
▶CVEListV5ibm/websphere_application_server4 versions+3

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-326g-ww7w-8qhj: IBM WebSphere Application Server 7↗2022-05-13
▶
CVEList
CVE-2018-1926: IBM WebSphere Application Server 7↗2018-12-12
▶
CVE-2018-1926 — Cross-Site Request Forgery in IBM | cvebase