CVE-2018-1926 : IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, cause

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious URL, a remote attacker could send a specially-crafted request. An attacker could exploit this vulnerability to perform CSRF attack and update available applications. IBM X-Force ID: 152992.

Published 2018-12-12 16:29:01

Updated 2019-10-09 23:39:22

Source IBM Corporation

View at NVD, CVE.org

Vulnerability category: Cross-site request forgery (CSRF)

Threat overview for CVE-2018-1926

Top countries where our scanners detected CVE-2018-1926

Top open port discovered on systems with this issue 9080

IPs affected by CVE-2018-1926 598

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2018-1926!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2018-1926

EPSS FAQ

0.12%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 46 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-1926

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High
4.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	2.8	1.4	IBM Corporation
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE ids for CVE-2018-1926

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-1926

https://www.ibm.com/support/docview.wss?uid=ibm10742301

IBM Security Bulletin: Potential cross-site request forgery in WebSphere Application Server Admin Console (CVE-2018-1926)
Patch;Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/152992

IBM WebSphere Application Server cross-site request forgery CVE-2018-1926 Vulnerability Report
VDB Entry;Vendor Advisory
http://www.securityfocus.com/bid/106204

IBM WebSphere Application Server/Virtual Enterprise CVE-2018-1926 Cross Site Scripting Vulnerability
Third Party Advisory;VDB Entry

Products affected by CVE-2018-1926