IBM WebSphere Portal CVE-2018-1820 Cross Site Scripting Vulnerability

Bugtraq ID:	107181
Class:	Input Validation Error
CVE:	CVE-2018-1820
Remote:	Yes
Local:	No
Published:	Sep 25 2018 12:00AM
Updated:	Sep 25 2018 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	IBM Websphere Portal 9.0.0.0 CF16 IBM Websphere Portal 9.0.0.0 CF15 IBM Websphere Portal 9.0.0.0 CF14 IBM Websphere Portal 9.0.0.0 IBM Websphere Portal 8.5.0.0 CF16 IBM Websphere Portal 8.5.0.0 CF15 IBM Websphere Portal 8.5.0.0 CF14 IBM Websphere Portal 8.5.0.0 CF11 IBM Websphere Portal 8.5.0.0 CF09 IBM Websphere Portal 8.5.0.0 CF08 IBM Websphere Portal 8.5.0.0 CF06 IBM Websphere Portal 8.5.0.0 IBM Websphere Portal 8.0.0.1 CF23 IBM Websphere Portal 8.0.0.1 CF22 IBM Websphere Portal 8.0.0.1 CF21 IBM Websphere Portal 8.0.0.1 CF20 IBM Websphere Portal 8.0.0.1 CF19 IBM Websphere Portal 8.0.0.1 CF18 IBM Websphere Portal 8.0.0.1 CF17 IBM Websphere Portal 8.0.0.1 CF16 IBM Websphere Portal 8.0.0.1 CF15 IBM Websphere Portal 8.0.0.1 CF14 IBM Websphere Portal 8.0.0.1 CF13 IBM Websphere Portal 8.0.0.1 CF12 IBM Websphere Portal 8.0.0.1 CF11 IBM Websphere Portal 8.0.0.1 CF09 IBM Websphere Portal 8.0.0.1 Cf08 IBM Websphere Portal 8.0.0.1 Cf07 IBM Websphere Portal 8.0.0.1 Cf06 IBM Websphere Portal 8.0.0.1 Cf05 IBM Websphere Portal 8.0.0.1 Cf04 IBM Websphere Portal 8.0.0.1 IBM Websphere Portal 8.0.0.0
Not Vulnerable:

IBM WebSphere Portal CVE-2018-1820 Cross Site Scripting Vulnerability

IBM WebSphere Portal is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

WebSphere Portal 9.0.0.0 through 9.0.0.0 CF16, 8.5.0.0 through 8.5.0.0 CF16, 8.0.0.0 through 8.0.0.1 CF23 are vulnerable.