Multiple IBM Products CVE-2018-1442 Cross Site Request Forgery Vulnerability

Bugtraq ID:	103368
Class:	Design Error
CVE:	CVE-2018-1442
Remote:	Yes
Local:	No
Published:	Mar 02 2018 12:00AM
Updated:	Mar 02 2018 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	IBM Response Time Monitoring Agent 8.1.4 IBM Cloud Application Performance Management Advanced Private 8.1.4 IBM Cloud Application Performance Management 8.1.4
Not Vulnerable:

Multiple IBM Products CVE-2018-1442 Cross Site Request Forgery Vulnerability

Multiple IBM Products are prone to an cross-site request forgery vulnerability because it fails to properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application.

The following products are vulnerable:

IBM Cloud Application Performance Management Advanced Private 8.1.4
IBM Cloud Application Performance Management 8.1.4
IBM Response Time Monitoring Agent 8.1.4

Multiple IBM Products CVE-2018-1442 Cross Site Request Forgery Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

Multiple IBM Products CVE-2018-1442 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple IBM Products CVE-2018-1442 Cross Site Request Forgery Vulnerability

References:

• IBM Homepage (IBM)
  
• Security Bulletin: Response Time Monitoring Agent is affected by a NoSQL Injecti (IBM)