CVE-2017-1769

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

IBM Business Process Manager 8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 136783.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
IBM	Business Process Manager	8.6

References

http://www.ibm.com/support/docview.wss?uid=swg22011579Patch, Vendor Advisory
http://www.securityfocus.com/bid/102777Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040298Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/136783VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22011579Patch, Vendor Advisory
http://www.securityfocus.com/bid/102777Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040298Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/136783VDB Entry, Vendor Advisory

Timeline

Published: Jan 24, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-176918.1Homeputer CL Studio fur HomeMatic 4.0 Rel 160808 and earlier uses cleartext to exchange the username and password between server and client CVE-2017-176927.5Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted Java CVE-2017-176934.3Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remo CVE-2017-176945.4Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter.CVE-2017-176958.8Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter.CVE-2017-176964.3Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php.CVE-2017-176978.6The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping.CVE-2017-176986.1Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec.CVE-2017-176999.8K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025ac DeviceIoControl request.CVE-2017-177009.8K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025a4 DeviceIoControl request.CVE-2017-177019.8K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025c8 DeviceIoControl request.CVE-2017-177036.1Synacor Zimbra Collaboration Suite (ZCS) before 8.8.3 has Persistent XSS.