Multiple IBM Products CVE-2018-2000 Cross Site Request Forgery Vulnerability

Bugtraq ID:	107851
Class:	Design Error
CVE:	CVE-2018-2000
Remote:	Yes
Local:	No
Published:	Apr 04 2019 12:00AM
Updated:	Apr 04 2019 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	IBM Business Process Manager 8.6.0.0 CF 2018.03 IBM Business Process Manager 8.6.0.0 CF 2017.12 IBM Business Process Manager 8.6.0.0 IBM Business Automation Workflow 18.0.0.1 IBM Business Automation Workflow 18.0.0.0
Not Vulnerable:

Multiple IBM Products CVE-2018-2000 Cross Site Request Forgery Vulnerability

Multiple IBM Products are prone to an unspecified cross-site request forgery vulnerability because it fails to properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application.

The following products are vulnerable:

IBM Business Automation Workflow 18.0.0.0 through 18.0.0.1
IBM Business Process Manager 8.6.0.0 Cumulative Fix 2017.12 through 8.6.0.0 Cumulative Fix 2018.03

Multiple IBM Products CVE-2018-2000 Cross Site Request Forgery Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

Multiple IBM Products CVE-2018-2000 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple IBM Products CVE-2018-2000 Cross Site Request Forgery Vulnerability

References:

• IBM Homepage (IBM)
  
• Cross-site request forgery vulnerability in IBM Business Automation Workflow (IBM)