Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM4ECFA5C2A7456F896D44B0E2BD545EC6EF39A1C4D63BE6899754E4B8B22572B7
HistoryJan 16, 2023 - 2:19 p.m.

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to spoofing attacks due to WAS Liberty (CVE-2018-25031, CVE-2021-46708)

2023-01-1614:19:00
www.ibm.com
12

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

65.8%

JSON

Summary

IBM Sterling Partner Engagement Manager has addressed all vulnerabilities published by WAS liberty below.

Vulnerability Details

CVEID:CVE-2018-25031
**DESCRIPTION:**swagger-ui could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a specially-crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217346 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

CVEID:CVE-2021-46708
**DESCRIPTION:**npm swagger-ui-dist could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim’s click actions and possibly launch further attacks against the victim.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217359 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, 6.2.1

Remediation/Fixes

Product Version Remediation
IBM Sterling Partner Engagement Manager Essentials Edition 6.1.2.7 http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Essentials_6.1.2.7&source=SAR
IBM Sterling Partner Engagement Manager Standard Edition 6.1.2.7 http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Standard_6.1.2.7&source=SAR
IBM Sterling Partner Engagement Manager Essentials Edition 6.2.0.5 http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Essentials_6.2.0.5&source=SAR
IBM Sterling Partner Engagement Manager Standard Edition 6.2.0.5 http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Standard_6.2.0.5&source=SAR
IBM Sterling Partner Engagement Manager Essentials Edition 6.2.1.2 http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Essentials_6.2.1.2&source=SAR
IBM Sterling Partner Engagement Manager Standard Edition 6.2.1.2 https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Standard_6.2.1.2&source=SAR

Workarounds and Mitigations

None

Related

ibm 36
github 2
veracode 3
cve 2
packetstorm 1
exploitdb 1
ubuntucve 1
osv 3
prion 2
zdt 1
ibm
ibm
Security Bulletin: Liberty for Java for IBM Cloud is vulnerable to spoofing attacks and clickjacking due to swagger-ui (CVE-2018-25031, CVE-2021-46708)
2022-10-07 16:01:56
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server Liberty shipped with IBM Tivoli Netcool Impact (CVE-2018-25031, CVE-2021-46708)
2022-07-28 06:16:09
Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server Liberty shipped with IBM Business Process Manager and IBM Business Automation Workflow
2022-09-14 15:28:14
github
github
Spoofing attack in swagger-ui-dist
2022-03-12 00:00:36
Spoofing attack in swagger-ui
2022-03-12 00:00:36
veracode
veracode
Clickjacking
2021-12-10 07:59:14
Clickjacking
2022-03-18 05:13:22
Spoofing Attack
2022-03-14 06:03:00
cve
cve
CVE-2021-46708
2022-03-11 07:15:00
CVE-2018-25031
2022-03-11 07:15:00
packetstorm
packetstorm
Swagger UI 4.1.3 Critical Information Misrepresentation
2023-04-20 00:00:00
exploitdb
exploitdb
Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information
2023-04-20 00:00:00
ubuntucve
ubuntucve
CVE-2018-25031
2022-03-11 00:00:00
osv
osv
Spoofing attack in swagger-ui
2022-03-12 00:00:36
CVE-2018-25031
2022-03-11 07:15:07
Spoofing attack in swagger-ui-dist
2022-03-12 00:00:36
prion
prion
Design/Logic Flaw
2022-03-11 07:15:00
Design/Logic Flaw
2022-03-11 07:15:00
zdt
zdt
Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information Exploit
2023-04-20 00:00:00

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

65.8%

JSON
Related for 4ECFA5C2A7456F896D44B0E2BD545EC6EF39A1C4D63BE6899754E4B8B22572B7
ibm36github2veracode3cve2packetstorm1exploitdb1ubuntucve1osv3prion2zdt1