Vulnerabilities > CVE-2018-1736 - Open Redirect vulnerability in IBM Websphere Portal

047910
CVSS 6.1 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
LOW
Integrity impact
LOW
Availability impact
NONE
network
low complexity
ibm
CWE-601
nessus
NVD
Published: 2018-09-27
Updated: 2019-10-09

Summary

IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 147906.

Vulnerable Configurations

Part Description Count
Application
Ibm
89

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Fake the Source of Data
    An adversary provides data under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or it might be an attempt by the adversary to assume the rights granted to another identity. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.

Nessus

NASL familyCGI abuses
NASL idWEBSPHERE_PORTAL_CVE-2018-1736.NASL
descriptionThe version of IBM WebSphere Portal installed on the remote Windows host is affected by an unspecified open redirect vulnerability due to improper validation of user-supplied input. A remote attacker, using a specially crafted URL, can exploit this flaw to redirect a victim to an arbitrary website.
last seen2020-06-01
modified2020-06-02
plugin id128998
published2019-09-18
reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/128998
titleIBM WebSphere Portal Open Redirect Vulnerability (CVE-2018-1736)
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(128998);
  script_version("1.2");
  script_cvs_date("Date: 2019/10/17 14:31:04");

  script_cve_id("CVE-2018-1736");
  script_bugtraq_id(105490);

  script_name(english:"IBM WebSphere Portal Open Redirect Vulnerability (CVE-2018-1736)");
  script_summary(english:"Checks for the installed patches.");

  script_set_attribute(attribute:"synopsis", value:
"The web portal application installed on remote Windows host is
affected by an open redirct vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of IBM WebSphere Portal installed on the remote Windows host is affected by an unspecified open redirect
vulnerability due to improper validation of user-supplied input. A remote attacker, using a specially crafted URL, can
exploit this flaw to redirect a victim to an arbitrary website.");
  script_set_attribute(attribute:"see_also", value:"https://www.ibm.com/support/docview.wss?uid=ibm10729683");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate fixes according to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-1736");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/09/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:websphere_portal");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("websphere_portal_installed.nbin");
  script_require_keys("installed_sw/IBM WebSphere Portal");

  exit(0);
}

include("websphere_portal_version.inc");

websphere_portal_check_version(
  checks:make_array(
    "7.0.0.0, 7.0.0.2, CF30", make_list("PH01459"),
    "8.0.0.0, 8.0.0.1, CF23", make_list("PH01459"),
    "8.5.0.0, 8.5.0.0, CF15", make_list("CF16"),
    "9.0.0.0, 9.0.0.0, CF15", make_list("CF16")
  ),
  severity:SECURITY_WARNING
);

References