{"containers": {"cna": {"affected": [{"product": "Connections", "vendor": "IBM", "versions": [{"status": "affected", "version": "5.0"}, {"status": "affected", "version": "5.5"}, {"status": "affected", "version": "6.0"}]}], "datePublic": "2018-09-12T00:00:00", "descriptions": [{"lang": "en", "value": "IBM Connections 5.0, 5.5, and 6.0 is vulnerable to an External Service Interaction attack, caused by improper validation of a request property. By submitting suitable payloads, an attacker could exploit this vulnerability to induce the Connections server to attack other systems. IBM X-Force ID: 148946."}], "metrics": [{"cvssV3_0": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "exploitCodeMaturity": "UNPROVEN", "integrityImpact": "NONE", "privilegesRequired": "LOW", "remediationLevel": "OFFICIAL_FIX", "reportConfidence": "CONFIRMED", "scope": "CHANGED", "temporalScore": 4.3, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.0/A:L/AC:H/AV:N/C:L/I:N/PR:L/S:C/UI:N/E:U/RC:C/RL:O", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Gain Access", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-09-14T11:57:01", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10731207"}, {"name": "ibm-connections-cve20181791-esi(148946)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/148946"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "DATE_PUBLIC": "2018-09-12T00:00:00", "ID": "CVE-2018-1791", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Connections", "version": {"version_data": [{"version_value": "5.0"}, {"version_value": "5.5"}, {"version_value": "6.0"}]}}]}, "vendor_name": "IBM"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IBM Connections 5.0, 5.5, and 6.0 is vulnerable to an External Service Interaction attack, caused by improper validation of a request property. By submitting suitable payloads, an attacker could exploit this vulnerability to induce the Connections server to attack other systems. IBM X-Force ID: 148946."}]}, "impact": {"cvssv3": {"BM": {"A": "L", "AC": "H", "AV": "N", "C": "L", "I": "N", "PR": "L", "S": "C", "UI": "N"}, "TM": {"E": "U", "RC": "C", "RL": "O"}}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Gain Access"}]}]}, "references": {"reference_data": [{"name": "https://www.ibm.com/support/docview.wss?uid=ibm10731207", "refsource": "CONFIRM", "url": "https://www.ibm.com/support/docview.wss?uid=ibm10731207"}, {"name": "ibm-connections-cve20181791-esi(148946)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/148946"}]}}}}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2018-1791", "datePublished": "2018-09-12T00:00:00", "dateReserved": "2017-12-13T00:00:00", "dateUpdated": "2018-09-14T11:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:connections:5.0:*:*:*:*:*:*:*", "matchCriteriaId": "6F522A3A-A452-4D8F-B7A0-3AC80A0DD4AE", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:connections:5.5:*:*:*:*:*:*:*", "matchCriteriaId": "8E02CAE7-BB6B-4AC7-AFE7-B1234ED0B8F3", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:connections:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "8200F7F9-94B4-4F72-82F0-E4AFC5D49CD2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "IBM Connections 5.0, 5.5, and 6.0 is vulnerable to an External Service Interaction attack, caused by improper validation of a request property. By submitting suitable payloads, an attacker could exploit this vulnerability to induce the Connections server to attack other systems. IBM X-Force ID: 148946."}, {"lang": "es", "value": "IBM Connections 5.0, 5.5 y 6.0 es vulnerable a un ataque de interacci\u00f3n con servicios externos, provocado por la validaci\u00f3n incorrecta de una propiedad de petici\u00f3n. Mediante el env\u00edo de cargas \u00fatiles adecuadas, un atacante podr\u00eda explotar esta vulnerabilidad para inducir al servidor Connections a que ataque otros sistemas. IBM X-Force ID: 148946."}], "id": "CVE-2018-1791", "lastModified": "2019-10-09T23:39:06.180", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.9, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 2.7, "source": "psirt@us.ibm.com", "type": "Secondary"}]}, "published": "2018-09-14T12:29:00.587", "references": [{"source": "psirt@us.ibm.com", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/148946"}, {"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10731207"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}