CVE-2018-1470
Last modified
CVE-2018-1470 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. IBM Sterling File Gateway 2.2.0 through 2.2.6 could allow a remote authenticated attacker to obtain sensitive information displayed in the URL that could lead to further attacks against the system. IBM X-Force ID: 140688.. EPSS estimates a 1.78% chance of exploitation in the next 30 days.
Description
IBM Sterling File Gateway 2.2.0 through 2.2.6 could allow a remote authenticated attacker to obtain sensitive information displayed in the URL that could lead to further attacks against the system. IBM X-Force ID: 140688.
Metrics
CVSS:3.0/A:N/AC:L/AV:N/C:L/I:N/PR:L/S:U/UI:N/E:U/RC:C/RL:O
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Sterling File Gateway | >= 2.2.0, <= 2.2.6 |
References
- http://www.ibm.com/support/docview.wss?uid=ibm10716997Patch, Vendor Advisory
- http://www.securityfocus.com/bid/104885Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/140688VDB Entry, Vendor Advisory
- http://www.ibm.com/support/docview.wss?uid=ibm10716997Patch, Vendor Advisory
- http://www.securityfocus.com/bid/104885Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/140688VDB Entry, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-1470?
How severe is CVE-2018-1470?
How do I fix CVE-2018-1470?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-14691An issue was discovered in Subsonic 6.1.1. The music tags fe…
- CVE-2018-14695Incorrect access control in the /mysql/api/diags.php endpoin…
- CVE-2018-14696Incorrect access control in the /mysql/api/drobo.php endpoin…
- CVE-2018-14697Cross-site scripting in the /DroboAccess/enable_user endpoin…
- CVE-2018-14698Cross-site scripting in the /DroboAccess/delete_user endpoin…
- CVE-2018-14699System command injection in the /DroboAccess/enable_user end…
- CVE-2018-14700Incorrect access control in the /mysql/api/logfile.php endpo…
- CVE-2018-14701System command injection in the /DroboAccess/delete_user end…
- CVE-2018-14702Incorrect access control in the /drobopix/api/drobo.php endp…
- CVE-2018-14703Incorrect access control in the /mysql/api/droboapp/data end…
- CVE-2018-14704Cross-site scripting in the MySQL API error page in Drobo 5N…
- CVE-2018-14705In Drobo 5N2 4.0.5, all optional applications lack any form …9.8
Are you affected by CVE-2018-1470?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST