IBM API Connect CVE-2018-1858 Cross Site Request Forgery Vulnerability

Bugtraq ID:	108898
Class:	Input Validation Error
CVE:	CVE-2018-1858
Remote:	Yes
Local:	No
Published:	Jun 14 2019 12:00AM
Updated:	Jun 14 2019 12:00AM
Credit:	IBM
Vulnerable:	IBM API Connect 5.0.8.6 iFix 1 IBM API Connect 5.0.8.6 IBM API Connect 5.0.8.5 IBM API Connect 5.0.8.4 IBM API Connect 5.0.8.3 IBM API Connect 5.0.8.2 IBM API Connect 5.0.8.1 IBM API Connect 5.0.8.0 IBM API Connect 5.0.7.2 IBM API Connect 5.0.7.1 IBM API Connect 5.0.7.0 IBM API Connect 5.0.6.6 IBM API Connect 5.0.6.5 IBM API Connect 5.0.6.4 IBM API Connect 5.0.6.3 IBM API Connect 5.0.6.2 IBM API Connect 5.0.6.0 IBM API Connect 5.0.3.0 IBM API Connect 5.0.2.0 IBM API Connect 5.0.1.0 IBM API Connect 5.0.0.1 IBM API Connect 5.0.0.0
Not Vulnerable:	IBM API Connect 5.0.8.6 iFix 2

IBM API Connect CVE-2018-1858 Cross Site Request Forgery Vulnerability

IBM API Connect is prone to cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

IBM API Connect versions 5.0.0.0 through 5.0.8.6 iFix1 are vulnerable.

IBM API Connect CVE-2018-1858 Cross Site Request Forgery Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM API Connect CVE-2018-1858 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM API Connect CVE-2018-1858 Cross Site Request Forgery Vulnerability

References:

• IBM Home Page (IBM)
  
• Security Bulletin: API Connect V5 is vulnerable to CSRF attacks (CVE-2018-1858) (IBM)