CVE-2017-1551

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

IBM API Connect 5.0.0.0 through 5.0.7.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 131291.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
IBM	API Connect	5.0.1.0; 5.0.0.0; 5.0.0.1; 5.0.2.0; 5.0.5.0; 5.0.6.0; 5.0.6.1; 5.0.6.2; 5.0.7.0; 5.0.7.1; 5.0.3.0; 5.0.4.0; 5.0.7.2

References

http://www.ibm.com/support/docview.wss?uid=swg22008372Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/131291VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22008372Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/131291VDB Entry, Vendor Advisory

Timeline

Published: Sep 25, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-155154.8NetApp SnapCenter Server prior to 4.0 is susceptible to cross site scripting vulnerability that could allow a privileged user to inject arbi CVE-2017-155168.8NetApp SnapCenter Server versions 1.1 through 2.x are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability which could be used t CVE-2017-155175.5AltaVault OST Plug-in versions prior to 1.2.2 may allow attackers to obtain sensitive information via unspecified vectors. All users are urg CVE-2017-155187.8All versions of OnCommand API Services prior to 2.1 and NetApp Service Level Manager prior to 1.0RC4 log a privileged database user account CVE-2017-155197.2Versions of SnapCenter 2.0 through 3.0.1 allow unauthenticated remote attackers to view and modify backup related data via the Plug-in for N CVE-2017-15525.4IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link,CVE-2017-155249.1The Application Firewall Pack (AFP, aka Web Application Firewall) component on Kemp Load Balancer devices with software before 7.2.40.1 allo CVE-2017-155254.5Prior to SEE v11.1.3MP1, Symantec Endpoint Encryption can be susceptible to a denial of service (DoS) attack, which is a type of attack wher CVE-2017-155266.8Prior to SEE v11.1.3MP1, Symantec Endpoint Encryption can be susceptible to a null pointer de-reference issue, which can result in a NullPoi CVE-2017-155276.8Prior to ITMS 8.1 RU4, the Symantec Management Console can be susceptible to a directory traversal exploit, which is a type of attack that c CVE-2017-155283.7Prior to v 7.6, the Install Norton Security (INS) product can be susceptible to a certificate spoofing vulnerability, which is a type of att CVE-2017-155296.2Prior to 4.4.1.10, the Norton Family Android App can be susceptible to a Denial of Service (DoS) exploit. A DoS attack is a type of attack w