CVE-2018-1885 - Vulnerability Details

Vendors	Products
Ibm	Business Automation Workflow Business Process Manager Business Process Manager Enterprise Service Bus Websphere Enterprise Service Bus

Link	Providers
http://www.securityfocus.com/bid/107863
https://exchange.xforce.ibmcloud.com/vulnerabilities/152020
https://www.ibm.com/support/docview.wss?uid=ibm10878106

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Business Automation Workflow", "vendor": "IBM", "versions": [{"status": "affected", "version": "18.0.0.0"}, {"status": "affected", "version": "18.0.0.1"}, {"status": "affected", "version": "18.0.0.2"}]}], "datePublic": "2019-04-04T00:00:00", "descriptions": [{"lang": "en", "value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "exploitCodeMaturity": "UNPROVEN", "integrityImpact": "NONE", "privilegesRequired": "NONE", "remediationLevel": "OFFICIAL_FIX", "reportConfidence": "CONFIRMED", "scope": "UNCHANGED", "temporalScore": 4.6, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AC:L/C:L/PR:N/A:N/I:N/AV:N/S:U/UI:N/RL:O/E:U/RC:C", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Obtain Information", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-04-11T11:06:03", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10878106"}, {"name": "ibm-business-cve20181885-info-disc (152020)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152020"}, {"name": "107863", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/107863"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "DATE_PUBLIC": "2019-04-04T00:00:00", "ID": "CVE-2018-1885", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Business Automation Workflow", "version": {"version_data": [{"version_value": "18.0.0.0"}, {"version_value": "18.0.0.1"}, {"version_value": "18.0.0.2"}]}}]}, "vendor_name": "IBM"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020."}]}, "impact": {"cvssv3": {"BM": {"A": "N", "AC": "L", "AV": "N", "C": "L", "I": "N", "PR": "N", "S": "U", "UI": "N"}, "TM": {"E": "U", "RC": "C", "RL": "O"}}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Obtain Information"}]}]}, "references": {"reference_data": [{"name": "https://www.ibm.com/support/docview.wss?uid=ibm10878106", "refsource": "CONFIRM", "title": "IBM Security Bulletin 878106 (Business Automation Workflow)", "url": "https://www.ibm.com/support/docview.wss?uid=ibm10878106"}, {"name": "ibm-business-cve20181885-info-disc (152020)", "refsource": "XF", "title": "X-Force Vulnerability Report", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152020"}, {"name": "107863", "refsource": "BID", "url": "http://www.securityfocus.com/bid/107863"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T04:14:38.618Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10878106"}, {"name": "ibm-business-cve20181885-info-disc (152020)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152020"}, {"name": "107863", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/107863"}]}]}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2018-1885", "datePublished": "2019-04-08T14:50:37.845952Z", "dateReserved": "2017-12-13T00:00:00", "dateUpdated": "2024-09-17T00:25:32.046Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Business Automation Workflow (string)

vendor : IBM (string)

versions : [ »

0 : { »

status : affected (string)

version : 18.0.0.0 (string)

}

1 : { »

status : affected (string)

version : 18.0.0.1 (string)

}

2 : { »

status : affected (string)

version : 18.0.0.2 (string)

}

]

}

]

datePublic : 2019-04-04T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020. (string)

}

]

metrics : [ »

0 : { »

cvssV3_0 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

exploitCodeMaturity : UNPROVEN (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

remediationLevel : OFFICIAL_FIX (string)

reportConfidence : CONFIRMED (string)

scope : UNCHANGED (string)

temporalScore : 4.6 (number)

temporalSeverity : MEDIUM (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AC:L/C:L/PR:N/A:N/I:N/AV:N/S:U/UI:N/RL:O/E:U/RC:C (string)

version : 3.0 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Obtain Information (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2019-04-11T11:06:03 (string)

orgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

shortName : ibm (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://www.ibm.com/support/docview.wss?uid=ibm10878106 (string)

}

1 : { »

name : ibm-business-cve20181885-info-disc (152020) (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_XF (string)

]

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/152020 (string)

}

2 : { »

name : 107863 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

]

url : http://www.securityfocus.com/bid/107863 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : psirt@us.ibm.com (string)

DATE_PUBLIC : 2019-04-04T00:00:00 (string)

ID : CVE-2018-1885 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Business Automation Workflow (string)

version : { »

version_data : [ »

0 : { »

version_value : 18.0.0.0 (string)

}

1 : { »

version_value : 18.0.0.1 (string)

}

2 : { »

version_value : 18.0.0.2 (string)

}

]

}

]

}

vendor_name : IBM (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020. (string)

}

]

}

impact : { »

cvssv3 : { »

BM : { »

A : N (string)

AC : L (string)

AV : N (string)

C : L (string)

I : N (string)

PR : N (string)

S : U (string)

UI : N (string)

}

TM : { »

E : U (string)

RC : C (string)

RL : O (string)

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Obtain Information (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://www.ibm.com/support/docview.wss?uid=ibm10878106 (string)

refsource : CONFIRM (string)

title : IBM Security Bulletin 878106 (Business Automation Workflow) (string)

url : https://www.ibm.com/support/docview.wss?uid=ibm10878106 (string)

}

1 : { »

name : ibm-business-cve20181885-info-disc (152020) (string)

refsource : XF (string)

title : X-Force Vulnerability Report (string)

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/152020 (string)

}

2 : { »

name : 107863 (string)

refsource : BID (string)

url : http://www.securityfocus.com/bid/107863 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T04:14:38.618Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://www.ibm.com/support/docview.wss?uid=ibm10878106 (string)

}

1 : { »

name : ibm-business-cve20181885-info-disc (152020) (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_XF (string)

2 : x_transferred (string)

]

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/152020 (string)

}

2 : { »

name : 107863 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

2 : x_transferred (string)

]

url : http://www.securityfocus.com/bid/107863 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

assignerShortName : ibm (string)

cveId : CVE-2018-1885 (string)

datePublished : 2019-04-08T14:50:37.845952Z (string)

dateReserved : 2017-12-13T00:00:00 (string)

dateUpdated : 2024-09-17T00:25:32.046Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "B1D36993-75D4-4EDE-8748-A3FDE4C69DF3", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "10B802CE-F898-4B60-9E2C-4D271F9211C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "FBD82AD2-FE98-4716-A60A-50554620A509", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "4E2DFAA5-B9A9-42D3-81FA-0815AD7BEE1E", "versionEndIncluding": "7.5.1.2", "versionStartIncluding": "7.5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "D7F25B9A-6BC9-474D-9EFD-80955C972F58", "versionEndIncluding": "8.0.1.3", "versionStartIncluding": "8.0.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "EC98B343-9E03-4056-8EB0-899B7A80CC88", "versionEndIncluding": "8.5.0.2", "versionStartIncluding": "8.5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "7021B830-3EE4-446D-8D87-BBD2097A023E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "8ED3C32B-7397-434D-B084-E92C7C6E2FE2", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:*", "matchCriteriaId": "6131DC1F-CBA6-4025-B5A5-98307274FA33", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:*", "matchCriteriaId": "439A4F14-76E6-4A21-A23C-D3DA243585A9", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "E245DD24-5C1E-4CF0-993D-0D79A5152594", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.06:*:*:*:*:*:*", "matchCriteriaId": "4B1024F5-71EE-4484-8F78-525EE9FF2CCE", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "324A0484-C50D-4400-B6FD-23D793F032AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2018.03:*:*:*:*:*:*", "matchCriteriaId": "8777DECA-6331-49BC-A579-252B079615EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_process_manager_enterprise_service_bus:8.6:*:*:*:*:*:*:*", "matchCriteriaId": "5B4BF5A7-0250-415E-94C8-E440E58CB366", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_enterprise_service_bus:*:*:*:*:*:*:*:*", "matchCriteriaId": "F0E50000-A948-4D59-A3AB-04F22AD29DB5", "versionEndIncluding": "7.5.1.2", "versionStartIncluding": "7.0.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020."}, {"lang": "es", "value": "IBM Business Automation Workflow en sus versiones 18.0.0.0.0, 18.0.0.1 y 18.0.0.0.2 podr\u00eda permitir a un atacante no autenticado obtener informaci\u00f3n sensible, utilizando una petici\u00f3n HTTP especialmente comprimida. IBM X-Force ID: 152020."}], "id": "CVE-2018-1885", "lastModified": "2024-11-21T04:00:32.140", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-04-08T15:29:00.700", "references": [{"source": "psirt@us.ibm.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/107863"}, {"source": "psirt@us.ibm.com", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152020"}, {"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10878106"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/107863"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152020"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10878106"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : B1D36993-75D4-4EDE-8748-A3FDE4C69DF3 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 10B802CE-F898-4B60-9E2C-4D271F9211C7 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:* (string)

matchCriteriaId : FBD82AD2-FE98-4716-A60A-50554620A509 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 4E2DFAA5-B9A9-42D3-81FA-0815AD7BEE1E (string)

versionEndIncluding : 7.5.1.2 (string)

versionStartIncluding : 7.5.0.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : D7F25B9A-6BC9-474D-9EFD-80955C972F58 (string)

versionEndIncluding : 8.0.1.3 (string)

versionStartIncluding : 8.0.0.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:ibm:business_process_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : EC98B343-9E03-4056-8EB0-899B7A80CC88 (string)

versionEndIncluding : 8.5.0.2 (string)

versionStartIncluding : 8.5.0.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 7021B830-3EE4-446D-8D87-BBD2097A023E (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:ibm:business_process_manager:8.5.6.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 8ED3C32B-7397-434D-B084-E92C7C6E2FE2 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf1:*:*:*:*:*:* (string)

matchCriteriaId : 6131DC1F-CBA6-4025-B5A5-98307274FA33 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:ibm:business_process_manager:8.5.6.0:cf2:*:*:*:*:*:* (string)

matchCriteriaId : 439A4F14-76E6-4A21-A23C-D3DA243585A9 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:ibm:business_process_manager:8.5.7.0:*:*:*:*:*:*:* (string)

matchCriteriaId : E245DD24-5C1E-4CF0-993D-0D79A5152594 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:ibm:business_process_manager:8.5.7.0:cf2017.06:*:*:*:*:*:* (string)

matchCriteriaId : 4B1024F5-71EE-4484-8F78-525EE9FF2CCE (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 324A0484-C50D-4400-B6FD-23D793F032AD (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:ibm:business_process_manager:8.6.0.0:cf2018.03:*:*:*:*:*:* (string)

matchCriteriaId : 8777DECA-6331-49BC-A579-252B079615EB (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:ibm:business_process_manager_enterprise_service_bus:8.6:*:*:*:*:*:*:* (string)

matchCriteriaId : 5B4BF5A7-0250-415E-94C8-E440E58CB366 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:ibm:websphere_enterprise_service_bus:*:*:*:*:*:*:*:* (string)

matchCriteriaId : F0E50000-A948-4D59-A3AB-04F22AD29DB5 (string)

versionEndIncluding : 7.5.1.2 (string)

versionStartIncluding : 7.0.0.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020. (string)

}

1 : { »

lang : es (string)

value : IBM Business Automation Workflow en sus versiones 18.0.0.0.0, 18.0.0.1 y 18.0.0.0.2 podría permitir a un atacante no autenticado obtener información sensible, utilizando una petición HTTP especialmente comprimida. IBM X-Force ID: 152020. (string)

}

]

id : CVE-2018-1885 (string)

lastModified : 2024-11-21T04:00:32.140 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : NONE (string)

baseScore : 5 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : NONE (string)

vectorString : AV:N/AC:L/Au:N/C:P/I:N/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 10 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 1.4 (number)

source : psirt@us.ibm.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2019-04-08T15:29:00.700 (string)

references : [ »

0 : { »

source : psirt@us.ibm.com (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : http://www.securityfocus.com/bid/107863 (string)

}

1 : { »

source : psirt@us.ibm.com (string)

tags : [ »

0 : VDB Entry (string)

1 : Vendor Advisory (string)

]

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/152020 (string)

}

2 : { »

source : psirt@us.ibm.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://www.ibm.com/support/docview.wss?uid=ibm10878106 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : http://www.securityfocus.com/bid/107863 (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : VDB Entry (string)

1 : Vendor Advisory (string)

]

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/152020 (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://www.ibm.com/support/docview.wss?uid=ibm10878106 (string)

}

]

sourceIdentifier : psirt@us.ibm.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-200 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object