CVE-2018-2015

MEDIUM

IBM API Connect < 2018.4.1.4 - Improper Input Validation

Title source: rule

Description

IBM API Connect 2018.1 and 2018.4.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 155195.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/108153

Vendor Advisory x_refsource_confirm

https://www.ibm.com/support/docview.wss?uid=ibm10882756

VDB Entry, Vendor Advisory vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/155195

Scores

CVSS v3 6.4

EPSS 0.0159

EPSS Percentile 72.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Details

CWE

CWE-20

Status published

Products (1)

ibm/api_connect 2018.1.0 - 2018.4.1.4

Published May 02, 2019

Tracked Since Feb 18, 2026