Medium severity · published Dec 20, 2018
CVE-2018-8892
A cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to make modifications to the UEM…
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
A cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to make modifications to the UEM settings in the context of a Management Console administrator.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UE
Unified Endpoint Manager · Blackberry
before 12.9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-8892
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-8892
Mitigation
http://support.blackberry.com/kb/articleDetail?articleNumber=000054162
More from Unified Endpoint Manager
7.5
CVE-2018-8890
An information disclosure vulnerability in the Management Console of BlackBerry UEM 12.8.0 and 12.8.1 could allow an attacker to take over a UEM user's session and perform…
6.9
CVE-2026-18085
Improper Input Validation Leads to Arbitrary File Download and Potential Denial of Service in BlackBerry UEM
6.1
CVE-2026-18084
Cross-Site Scripting (XSS) in Management Console of BlackBerry UEM
6.1
CVE-2017-17442
In BlackBerry UEM Management Console version 12.7.1 and earlier, a reflected cross-site scripting vulnerability that could allow an attacker to execute script commands in the…
6.1
CVE-2017-3894
A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12.6.1 and earlier, and all versions of BES12, allows…