CVE-2018-1382: XSS
Published Feb 7, 2018
·Updated
IBM API Connect 5.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138079.
Affected Software
6 affected components
IBM API Connect>=5.0.0.0<=5.0.6.4
IBM API Connect=5.0.7.0
IBM API Connect=5.0.7.1
IBM API Connect=5.0.7.2
IBM API Connect=5.0.8.0
IBM API Connect=5.0.8.1
Remediation
Patch Available
Event History
Feb 7, 2018
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-1382?
CVE-2018-1382 is categorized as a moderate severity cross-site scripting vulnerability.
2
How do I fix CVE-2018-1382?
To fix CVE-2018-1382, upgrade IBM API Connect to version 5.0.8.1 or later.
3
What impact does CVE-2018-1382 have on IBM API Connect?
CVE-2018-1382 allows attackers to embed arbitrary JavaScript code, potentially leading to credentials disclosure.
4
Which versions of IBM API Connect are affected by CVE-2018-1382?
IBM API Connect versions from 5.0.0.0 to 5.0.8.0 are affected by CVE-2018-1382.
5
Is CVE-2018-1382 exploitable in a trusted session?
Yes, CVE-2018-1382 can be exploited in a trusted session, allowing for potential credential theft.