CVE-2017-1398

2017-07-0600:00:00

ibm

www.cve.org

5.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.8%

JSON

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 127385.

CNA Affected

[
  {
    "product": "WebSphere Commerce Enterprise",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "6.0"
      },
      {
        "status": "affected",
        "version": "7.0"
      },
      {
        "status": "affected",
        "version": "8.0"
      }
    ]
  }
]