CVE-2018-1951: XSS

Published Jan 4, 2019

Updated

IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153494.

Affected Software

6 affected components

IBM Rational Publishing Engine=2.1.2

IBM Rational Publishing Engine=6.0.5

IBM Rational Publishing Engine=6.0.6

IBM Engineering Lifecycle Optimization - Publishing=2.1.2

IBM Engineering Lifecycle Optimization - Publishing=6.0.5

IBM Engineering Lifecycle Optimization - Publishing=6.0.6

Remediation

Patch Available

https://www.ibm.com/support/docview.wss?uid=ibm10792081

Event History

Jan 4, 2019

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:29 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID for the IBM Publishing Engine vulnerability?

The vulnerability ID for the IBM Publishing Engine vulnerability is CVE-2018-1951.

What is the severity level of CVE-2018-1951?

The severity level of CVE-2018-1951 is medium (5.4).

Which software versions are affected by CVE-2018-1951?

IBM Publishing Engine versions 2.1.2, 6.0.5, and 6.0.6 are affected by CVE-2018-1951.

What is cross-site scripting (XSS)?

Cross-site scripting (XSS) is a type of security vulnerability where attackers inject malicious scripts into web pages viewed by other users.

How can the IBM Publishing Engine vulnerability be fixed?

To fix the IBM Publishing Engine vulnerability, apply the patches or updates provided by IBM.