Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM479BFE4D144DD6AF50900A3DB058F11048CFA4F36225A93474B13BE5FA340CF8
HistorySep 14, 2022 - 3:02 p.m.

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Digital Business Automation Workflow family products (CVE-2018-1926)

2022-09-1415:02:20
www.ibm.com
9

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

46.6%

JSON

Summary

WebSphere Application Server is shipped as a component of IBM Business Automation Workflow, IBM Business Process Manager, WebSphere Process Server, WebSphere Enterprise Service Bus, and WebSphere Lombardi Edition. WebSphere Application Server Liberty is shipped as a component of the optional BPM component Process Federation Server and User Management Service. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional and IBM WebSphere Application Server Liberty have been published in a security bulletin.

Vulnerability Details

Please consult the Security Bulletin: Potential cross-site request forgery in WebSphere Application Server Admin Console (CVE-2018-1926) for vulnerability details and information about fixes.

Affected Products and Versions

- WebSphere Process Server V7.0.0.0 through V7.0.0.5 (and earlier unsupported releases)

- WebSphere Lombardi Edition V7.2.0.0 through V7.2.0.5 (and earlier unsupported releases)

- WebSphere Enterprise Service Bus V7.0.0.0 through V7.0.0.5 (and earlier unsupported releases)

- WebSphere Enterprise Service Bus V7.5.0.0 through V7.5.1.2

- IBM Business Process Manager V7.5.0.0 through V7.5.1.2

- IBM Business Process Manager V8.0.0.0 through V8.0.1.3

- IBM Business Process Manager V8.5.0.0 through V8.5.0.2

- IBM Business Process Manager V8.5.5.0

- IBM Business Process Manager V8.5.6.0 through V8.5.6.0 CF2

- IBM Business Process Manager V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06

- IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03

- IBM Business Process Manager Enterprise Service Bus V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03

- IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2

Affected configurations

Vulners
Node
ibmbusiness_automation_workflowMatch18.0.0.0
OR
ibmbusiness_automation_workflowMatch18.0.0.1
OR
ibmbusiness_automation_workflowMatch18.0.0.2
OR
ibmbusiness_process_managerMatch8.6.0.
OR
ibmbusiness_process_managerMatch201803
OR
ibmbusiness_process_managerMatch8.6.0.
OR
ibmbusiness_process_managerMatch201712
OR
ibmbusiness_process_managerMatch8.6
OR
ibmbusiness_process_managerMatch8.6.0.express
OR
ibmbusiness_process_managerMatch201803express
OR
ibmbusiness_process_managerMatch8.6.0.express
OR
ibmbusiness_process_managerMatch201712express
OR
ibmbusiness_process_managerMatch8.6express
OR
ibmbusiness_process_managerMatch8.5.7.express
OR
ibmbusiness_process_managerMatch201706express
OR
ibmbusiness_process_managerMatch8.5.7.express
OR
ibmbusiness_process_managerMatch201703express
OR
ibmbusiness_process_managerMatch8.5.7.express
OR
ibmbusiness_process_managerMatch201612express
OR
ibmbusiness_process_managerMatch8.5.7.express
OR
ibmbusiness_process_managerMatch201609express
OR
ibmbusiness_process_managerMatch8.5.7.express
OR
ibmbusiness_process_managerMatch201606express
OR
ibmbusiness_process_managerMatch8.5.7express
OR
ibmbusiness_process_managerMatch8.5.6.2express
OR
ibmbusiness_process_managerMatch8.5.6.1express
OR
ibmbusiness_process_managerMatch8.5.6express
OR
ibmbusiness_process_managerMatch8.5.5express
OR
ibmbusiness_process_managerMatch8.5.0.2express
OR
ibmbusiness_process_managerMatch8.5.0.1express
OR
ibmbusiness_process_managerMatch8.5express
OR
ibmbusiness_process_managerMatch8.0.1.3express
OR
ibmbusiness_process_managerMatch8.0.1.2express
OR
ibmbusiness_process_managerMatch8.0.1.1express
OR
ibmbusiness_process_managerMatch8.0.1express
OR
ibmbusiness_process_managerMatch8.0express
OR
ibmbusiness_process_managerMatch7.5.1.2express
OR
ibmbusiness_process_managerMatch7.5.1.1express
OR
ibmbusiness_process_managerMatch7.5.1express
OR
ibmbusiness_process_managerMatch7.5.0.1express
OR
ibmbusiness_process_managerMatch7.5express
OR
ibmbusiness_process_managerMatch8.5.7.standard
OR
ibmbusiness_process_managerMatch201706standard
OR
ibmbusiness_process_managerMatch8.5.7.standard
OR
ibmbusiness_process_managerMatch201703standard
OR
ibmbusiness_process_managerMatch8.5.7.standard
OR
ibmbusiness_process_managerMatch201612standard
OR
ibmbusiness_process_managerMatch8.5.7.standard
OR
ibmbusiness_process_managerMatch201609standard
OR
ibmbusiness_process_managerMatch8.5.7.standard
OR
ibmbusiness_process_managerMatch201606standard
OR
ibmbusiness_process_managerMatch8.5.7standard
OR
ibmbusiness_process_managerMatch8.5.6.2standard
OR
ibmbusiness_process_managerMatch8.5.6.1standard
OR
ibmbusiness_process_managerMatch8.5.6standard
OR
ibmbusiness_process_managerMatch8.5.5standard
OR
ibmbusiness_process_managerMatch8.5.0.2standard
OR
ibmbusiness_process_managerMatch8.5.0.1standard
OR
ibmbusiness_process_managerMatch8.5standard
OR
ibmbusiness_process_managerMatch8.0.1.3standard
OR
ibmbusiness_process_managerMatch8.0.1.2standard
OR
ibmbusiness_process_managerMatch8.0.1.1standard
OR
ibmbusiness_process_managerMatch8.0.1standard
OR
ibmbusiness_process_managerMatch8.0standard
OR
ibmbusiness_process_managerMatch7.5.1.2standard
OR
ibmbusiness_process_managerMatch7.5.1.1standard
OR
ibmbusiness_process_managerMatch7.5.1standard
OR
ibmbusiness_process_managerMatch7.5.0.1standard
OR
ibmbusiness_process_managerMatch7.5standard
OR
ibmbusiness_process_managerMatch8.6advanced
OR
ibmbusiness_process_managerMatch8.5.7.advanced
OR
ibmbusiness_process_managerMatch201706advanced
OR
ibmbusiness_process_managerMatch8.5.7.advanced
OR
ibmbusiness_process_managerMatch201703advanced
OR
ibmbusiness_process_managerMatch8.5.7.advanced
OR
ibmbusiness_process_managerMatch201612advanced
OR
ibmbusiness_process_managerMatch8.5.7.advanced
OR
ibmbusiness_process_managerMatch201609advanced
OR
ibmbusiness_process_managerMatch8.5.7.advanced
OR
ibmbusiness_process_managerMatch201606advanced
OR
ibmbusiness_process_managerMatch8.5.7advanced
OR
ibmbusiness_process_managerMatch8.5.6.2advanced
OR
ibmbusiness_process_managerMatch8.5.6.1advanced
OR
ibmbusiness_process_managerMatch8.5.6advanced
OR
ibmbusiness_process_managerMatch8.5.5advanced
OR
ibmbusiness_process_managerMatch8.5.0.2advanced
OR
ibmbusiness_process_managerMatch8.5.0.1advanced
OR
ibmbusiness_process_managerMatch8.5advanced
OR
ibmbusiness_process_managerMatch8.0.1.3advanced
OR
ibmbusiness_process_managerMatch8.0.1.2advanced
OR
ibmbusiness_process_managerMatch8.0.1.1advanced
OR
ibmbusiness_process_managerMatch8.0.1advanced
OR
ibmbusiness_process_managerMatch8.0advanced
OR
ibmbusiness_process_managerMatch7.5.1.2advanced
OR
ibmbusiness_process_managerMatch7.5.1.1advanced
OR
ibmbusiness_process_managerMatch7.5.1advanced
OR
ibmbusiness_process_managerMatch7.5.0.1advanced
OR
ibmbusiness_process_managerMatch7.5advanced
OR
ibmwebsphereMatch7.2.0.5lombardi
OR
ibmwebsphereMatch7.2.0.4lombardi
OR
ibmwebsphereMatch7.2.0.3lombardi
OR
ibmwebsphereMatch7.2.0.2lombardi
OR
ibmwebsphereMatch7.2.0.1lombardi
OR
ibmwebsphereMatch7.2lombardi
OR
ibmwebsphereMatch7.1.0.3lombardi
OR
ibmwebsphereMatch7.1.0.2lombardi
OR
ibmwebsphereMatch7.1.0.1lombardi
OR
ibmwebsphereMatch7.1lombardi
OR
ibmwebsphereMatch7.0.1lombardi
OR
ibmwebsphere_enterprise_service_busMatch7.5.1.2
OR
ibmwebsphere_enterprise_service_busMatch7.5.1.1
OR
ibmwebsphere_enterprise_service_busMatch7.5.1
OR
ibmwebsphere_enterprise_service_busMatch7.5.0.1
OR
ibmwebsphere_enterprise_service_busMatch7.5
OR
ibmwebsphere_enterprise_service_busMatch7.0.0.5
OR
ibmwebsphere_enterprise_service_busMatch7.0.0.4
OR
ibmwebsphere_enterprise_service_busMatch7.0.0.3
OR
ibmwebsphere_enterprise_service_busMatch7.0.0.2
OR
ibmwebsphere_enterprise_service_busMatch7.0.0.1
OR
ibmwebsphere_enterprise_service_busMatch7.0
OR
ibmbusiness_process_manager_enterprise_service_busMatch8.6.0.0
OR
ibmwebsphere_enterprise_service_busMatchanyregistry

Related

ibm 24
cve 1
prion 1
cvelist 1
nessus 1
nvd 1
ibm
ibm
Security Bulletin: A Security Vulnerability has been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2018-1926)
2018-12-13 20:50:01
Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager (CVE-2018-1926)
2023-01-17 17:37:20
Security Bulletin: Potential cross-site request forgery vulnerability in IBM WebSphere Application Server Admin Console shipped with Jazz for Service Management (CVE-2018-1926)
2019-03-28 09:15:01
cve
cve
CVE-2018-1926
2018-12-12 16:29:01
prion
prion
Cross site request forgery (csrf)
2018-12-12 16:29:00
cvelist
cvelist
CVE-2018-1926
2018-12-10 00:00:00
nessus
nessus
IBM WebSphere Application Server 8.5.x < 8.5.5.15 / 9.0.0.x < 9.0.0.10 Cross-Site Request Forgery (CVE-2018-1926)
2020-01-28 00:00:00
nvd
nvd
CVE-2018-1926
2018-12-12 16:29:01

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

46.6%

JSON
Related for 479BFE4D144DD6AF50900A3DB058F11048CFA4F36225A93474B13BE5FA340CF8
ibm24cve1prion1cvelist1nessus1nvd1