Medium severity · published Jan 19, 2018
CVE-2018-1362
IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 within Citizen Portal could allow an authenticated user to withdraw other user's submitted applications from the…
5.0
CVSS
0.6%
EPSS
No
On KEV
Description
IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 within Citizen Portal could allow an authenticated user to withdraw other user's submitted applications from the system and possibly obtain privileges. IBM X-Force ID: 137380.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Cram Social Program Management · IBM
6.0.5; 6.1.1; 6.2.0; 7.0.1 · source: vendor
CS
Curam Social Program Management · Ibm
6.0.5; 6.1.1.0; 6.2.0.0; 7.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1362
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1362
Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22012528
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/137380
More from Cram Social Program Management
8.8
CVE-2018-2001
IBM Cram Social Program Management 6.1.1, 6.2.0, 7.0.4, and 7.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized…
6.5
CVE-2017-1110
IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 contains an unspecified vulnerability that could allow an authenticated user to view the incidents of a higher…
6.1
CVE-2017-1195
IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack
5.4
CVE-2017-1739
IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 is vulnerable to cross-site scripting
5.4
CVE-2017-1740
IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting