← Vulnerability feed

Vulnerability record · CVE-2017-1156 · published 5 May 2017

CVE-2017-1156: Ibm websphere portal open redirect vulnerability

Ibm · Websphere Portal

IBM WebSphere Portal 8.5 and 9.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force. ID: 122592

8.8 CVSS 3.0 High EPSS 1.1% · top 34.5% CWE-601 · Open redirect
8.8CVSS 3.0 base score, v2 6.8
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

IBM WebSphere Portal 8.5 and 9.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force. ID: 122592

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.ibm.com/support/docview.wss?uid=swg22000153 PatchVendor Advisory
http://www.securityfocus.com/bid/98340 Broken Link
http://www.securitytracker.com/id/1038390
http://www.ibm.com/support/docview.wss?uid=swg22000153 PatchVendor Advisory
http://www.securityfocus.com/bid/98340 Broken Link
http://www.securitytracker.com/id/1038390

Track CVE-2017-1156 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-5675Ibm websphere portal permissions and access controls vulnerabilityUnspecified vulnerability in IBM WebSphere Portal 6.0 before 6.0.1.5 has unknown impact and attack vectors related to "Access problems with BasicAuth…EPSS 1.5%8.8CVE-2016-2901Ibm websphere portal cross-site request forgery vulnerabilityCross-site request forgery (CSRF) vulnerability in the PA_Theme_Creator application in IBM WebSphere Portal 8.5 CF08 through CF10 and Web Content Man…EPSS 0.92%7.8CVE-2013-2951Ibm websphere portal vulnerabilityIBM WebSphere Portal 7.0.0.x and 8.0.0.x write passwords to a trace file when tracing is enabled for the Selfcare Portlet (Profile Management), which…EPSS 0.37%7.8CVE-2015-7419Ibm websphere portal vulnerabilityIBM WebSphere Portal 8.0.0.1 before CF19 and 8.5.0 before CF09 allows remote attackers to cause a denial of service (memory consumption) via crafted …EPSS 3.2%7.8CVE-2015-1943Ibm websphere portal vulnerabilityIBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF17, and 8.5.0 bef…EPSS 2.7%7.8CVE-2015-1899Ibm websphere portal vulnerabilityIBM WebSphere Portal 8.5 through CF05 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.EPSS 1.9%7.8CVE-2015-1886Ibm websphere portal vulnerabilityThe Remote Document Conversion Service (DCS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF…EPSS 3.4%7.5CVE-2017-1577Ibm websphere portal path traversal vulnerabilityIBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-c…EPSS 2.9%

Source: NIST National Vulnerability Database (record CVE-2017-1156), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.