CVE-2018-1789

IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack. IBM X-Force ID: 148939.

• CWE-918

• https://exchange.xforce.ibmcloud.com/vulnerabilities/148939VDB Entry, Vendor Advisory
• https://www.ibm.com/support/docview.wss?uid=ibm10728517Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/148939VDB Entry, Vendor Advisory
• https://www.ibm.com/support/docview.wss?uid=ibm10728517Patch, Vendor Advisory

Published

Sep 7, 2018

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17882An Integer overflow vulnerability exists in the batchTransfe…
• CVE-2018-17883An issue was discovered in Open Ticket Request System (OTRS)…6.1
• CVE-2018-17884XSS exists in admin/gb-dashboard-widget.php in the Gwolle Gu…
• CVE-2018-17886An issue was discovered in JEESNS 1.3. The XSS filter in com…
• CVE-2018-17888NUUO CMS all versions 3.1 and prior, The application uses a …
• CVE-2018-17889In WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 a…
• CVE-2018-17890NUUO CMS all versions 3.1 and prior, The application uses in…9.8
• CVE-2018-17891Carestream Vue RIS, RIS Client Builds: Version 11.2 and prio…
• CVE-2018-17892NUUO CMS all versions 3.1 and prior, The application impleme…
• CVE-2018-17893LAquis SCADA Versions 4.1.0.3870 and prior has an untrusted …
• CVE-2018-17894NUUO CMS all versions 3.1 and prior, The application creates…
• CVE-2018-17895LAquis SCADA Versions 4.1.0.3870 and prior has several out-o…