Security Bulletin: External Service invocation in IBM Business Space affects IBM Business Monitor (CVE-2018-1885)

Summary

A vulnerability in IBM Business Space can allow an attacker to cause an external service invocation.

Vulnerability Details

CVEID: CVE-2018-1885
DESCRIPTION: IBM Business Space could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request.
CVSS Base Score: 5.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/152020&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

- IBM Business Monitor V8.5.5

- IBM Business Monitor V8.5.6

- IBM Business Monitor V8.5.7

Remediation/Fixes

Install interim fix JR60524 _ _as appropriate for your current version.

Workarounds and Mitigations

None