Login Request a demo
Medium severity · published Dec 20, 2018
CVE-2018-8888
A stored cross-site scripting (XSS) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.10.0 could allow an attacker to store script commands that…
4.8
CVSS
0.5%
EPSS
No
On KEV
Description
A stored cross-site scripting (XSS) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.10.0 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UE
Unified Endpoint Manager · Blackberry
before 12.10.0 · source: NVD
Affected product
UE
Unified Endpoint Manager
Blackberry
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-8888
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-8888
Mitigation
http://support.blackberry.com/kb/articleDetail?articleNumber=000054162
More from Unified Endpoint Manager
7.5
CVE-2018-8890
An information disclosure vulnerability in the Management Console of BlackBerry UEM 12.8.0 and 12.8.1 could allow an attacker to take over a UEM user's session and perform…
6.9
CVE-2026-18085
Improper Input Validation Leads to Arbitrary File Download and Potential Denial of Service in BlackBerry UEM
6.5
CVE-2018-8892
A cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to make modifications to the UEM…
6.1
CVE-2026-18084
Cross-Site Scripting (XSS) in Management Console of BlackBerry UEM
6.1
CVE-2017-17442
In BlackBerry UEM Management Console version 12.7.1 and earlier, a reflected cross-site scripting vulnerability that could allow an attacker to execute script commands in the…