CVE-2017-1772

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

IBM Worklight (IBM MobileFirst Platform Foundation 6.3, 7.0, 7.1, and 8.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 136786.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
IBM	MobileFirst Platform Foundation	6.3; 7.0; 7.1; 8.0

References

http://www.ibm.com/support/docview.wss?uid=swg2C1000369Patch, Vendor Advisory
http://www.securityfocus.com/bid/103735Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/136786VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg2C1000369Patch, Vendor Advisory
http://www.securityfocus.com/bid/103735Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/136786VDB Entry, Vendor Advisory

Timeline

Published: Apr 4, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-177219.8CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, assignto, building, dom CVE-2017-177226.5In Exiv2 0.26, there is a reachable assertion in the readHeader function in bigtiffimage.cpp, which will lead to a remote denial of service CVE-2017-177238.1In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp. Remote attackers can exploit thi CVE-2017-177246.5In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::IptcData::printStructure function in iptc.cpp, related to the "!= 0x1c" CVE-2017-177256.5In Exiv2 0.26, there is an integer overflow leading to a heap-based buffer over-read in the Exiv2::getULong function in types.cpp. Remote at CVE-2017-177278.8DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templ CVE-2017-17734.0IBM DataPower Gateways 7.1, 7,2, 7.5, and 7.6 could allow an attacker using man-in-the-middle techniques to spoof DNS responses to perform D CVE-2017-177309.8DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php.CVE-2017-177319.8DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.CVE-2017-177339.8Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.CVE-2017-177349.8CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions.CVE-2017-177359.8CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.