mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-29 05:56:59 +00:00
98 lines
2.7 KiB
JSON
98 lines
2.7 KiB
JSON
{
|
|
"CVE_data_meta" : {
|
|
"ASSIGNER" : "psirt@us.ibm.com",
|
|
"DATE_PUBLIC" : "2018-11-04T00:00:00",
|
|
"ID" : "CVE-2018-1774",
|
|
"STATE" : "PUBLIC"
|
|
},
|
|
"affects" : {
|
|
"vendor" : {
|
|
"vendor_data" : [
|
|
{
|
|
"product" : {
|
|
"product_data" : [
|
|
{
|
|
"product_name" : "API Connect",
|
|
"version" : {
|
|
"version_data" : [
|
|
{
|
|
"version_value" : "5.0.0.0"
|
|
},
|
|
{
|
|
"version_value" : "2018.1"
|
|
},
|
|
{
|
|
"version_value" : "5.0.8.4"
|
|
},
|
|
{
|
|
"version_value" : "2018.3.6"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"vendor_name" : "IBM"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"data_format" : "MITRE",
|
|
"data_type" : "CVE",
|
|
"data_version" : "4.0",
|
|
"description" : {
|
|
"description_data" : [
|
|
{
|
|
"lang" : "eng",
|
|
"value" : "IBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via the developer portal and analytics that could contain malicious commands that would be executed once opened by an administrator. IBM X-Force ID: 148692."
|
|
}
|
|
]
|
|
},
|
|
"impact" : {
|
|
"cvssv3" : {
|
|
"BM" : {
|
|
"A" : "L",
|
|
"AC" : "L",
|
|
"AV" : "N",
|
|
"C" : "H",
|
|
"I" : "H",
|
|
"PR" : "L",
|
|
"S" : "C",
|
|
"SCORE" : "8.900",
|
|
"UI" : "R"
|
|
},
|
|
"TM" : {
|
|
"E" : "U",
|
|
"RC" : "C",
|
|
"RL" : "O"
|
|
}
|
|
}
|
|
},
|
|
"problemtype" : {
|
|
"problemtype_data" : [
|
|
{
|
|
"description" : [
|
|
{
|
|
"lang" : "eng",
|
|
"value" : "Gain Access"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"references" : {
|
|
"reference_data" : [
|
|
{
|
|
"name" : "https://www.ibm.com/support/docview.wss?uid=ibm10737867",
|
|
"refsource" : "CONFIRM",
|
|
"url" : "https://www.ibm.com/support/docview.wss?uid=ibm10737867"
|
|
},
|
|
{
|
|
"name" : "ibm-api-cve20181774-script-injection(148692)",
|
|
"refsource" : "XF",
|
|
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/148692"
|
|
}
|
|
]
|
|
}
|
|
}
|