CVE-2018-1926 describes a Cross-Site Request Forgery (CSRF) vulnerability within the IBM WebSphere Application Server Admin Console, affecting versions 7.0, 8.0, 8.5, and 9.0. This flaw, stemming from improper input validation, allows a remote attacker to send specially crafted requests by tricking a user into visiting a malicious URL, potentially leading to unauthorized updates of available applications. The vulnerability carries a CVSS v3.0 score of 8.8 (High), indicating a critical severity with a network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Successful exploitation could grant an attacker significant control over application configurations. Despite its high severity, there is no evidence of active exploitation, nor is public exploit code available in Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 7.0.0.0, <= 7.0.0.45CPE matchmatch criteria | cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* | ||
>= 8.0.0.0, <= 8.0.0.15CPE matchmatch criteria | cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* | ||
>= 8.5.0.0, <= 8.5.5.14CPE matchmatch criteria | cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* | ||
>= 9.0.0.0, <= 9.0.0.9CPE matchmatch criteria | cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.