CVE-2017-1398

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 127385.

• CWE-601

• http://www.ibm.com/support/docview.wss?uid=swg22005360Mitigation, Vendor Advisory
• http://www.securityfocus.com/bid/99491Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/127385VDB Entry
• http://www.ibm.com/support/docview.wss?uid=swg22005360Mitigation, Vendor Advisory
• http://www.securityfocus.com/bid/99491Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/127385VDB Entry

Published

Jul 10, 2017

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-13974Rejected reason: This candidate is unused by its CNA.
• CVE-2017-13975Rejected reason: This candidate is unused by its CNA.
• CVE-2017-13976Rejected reason: This candidate is unused by its CNA.
• CVE-2017-13977Rejected reason: This candidate is unused by its CNA.
• CVE-2017-13978Rejected reason: This candidate is unused by its CNA.
• CVE-2017-13979Rejected reason: This candidate is unused by its CNA.
• CVE-2017-13980Rejected reason: This candidate is unused by its CNA.
• CVE-2017-13981Rejected reason: This candidate is unused by its CNA.
• CVE-2017-13982A directory traversal vulnerability in HPE BSM Platform Appl…
• CVE-2017-13983An authentication vulnerability in HPE BSM Platform Applicat…
• CVE-2017-13984An authentication vulnerability in HPE BSM Platform Applicat…
• CVE-2017-13985An authentication vulnerability in HPE BSM Platform Applicat…