CVE-2018-1789

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack. IBM X-Force ID: 148939.

Metrics

CVSS 3.0 9.9/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
IBM	API Connect	2018.2.1; 2018.2.2; 2018.2.3; 2018.2.4; 2018.1.0; 2018.2.5; 2018.2.6; 2018.2.7; 2018.2.8; 2018.2.9; 2018.2.10; 2018.2.11; 2018.3.1; 2018.3.2; 2018.3.3; 2018.3.4

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/148939VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10728517Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/148939VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10728517Patch, Vendor Advisory

Timeline

Published: Sep 7, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-178909.8NUUO CMS all versions 3.1 and prior, The application uses insecure and outdated software components for functionality, which could allow arb CVE-2018-178913.7Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream se CVE-2018-178928.8NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security featu CVE-2018-178939.8LAquis SCADA Versions 4.1.0.3870 and prior has an untrusted pointer dereference vulnerability, which may allow remote code execution.CVE-2018-178949.8NUUO CMS all versions 3.1 and prior, The application creates default accounts that have hard-coded passwords, which could allow an attacker CVE-2018-178959.8LAquis SCADA Versions 4.1.0.3870 and prior has several out-of-bounds read vulnerabilities, which may allow remote code execution.CVE-2018-178968.1Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The affected controllers utilize hard-coded crede CVE-2018-178979.8LAquis SCADA Versions 4.1.0.3870 and prior has several integer overflow to buffer overflow vulnerabilities, which may allow remote code exec CVE-2018-178987.5Yokogawa STARDOM Controllers FCJ,FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The controller application fails to prevent memory CVE-2018-178998.8LAquis SCADA Versions 4.1.0.3870 and prior has a path traversal vulnerability, which may allow remote code execution.CVE-2018-17908.8IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allo CVE-2018-179009.8Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The web application improperly protects credentia