← Vulnerability feed

Vulnerability record · CVE-2018-1712 · published 16 August 2018

CVE-2018-1712: Ibm api connect cross-site request forgery vulnerability

Ibm · Api Connect

IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input parameters can trick the server into making potentially malicious calls within the trusted network. IBM X-Force ID: 146370.

9.9 CVSS 3.0 Critical EPSS 0.71% · top 48.2% CWE-352 · Cross-site request forgery
9.9CVSS 3.0 base score, v2 7.5
0.71%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input parameters can trick the server into making potentially malicious calls within the trusted network. IBM X-Force ID: 146370.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://exchange.xforce.ibmcloud.com/vulnerabilities/146370 VDB EntryVendor Advisory
https://www-01.ibm.com/support/docview.wss?uid=ibm10716169 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/146370 VDB EntryVendor Advisory
https://www-01.ibm.com/support/docview.wss?uid=ibm10716169 Vendor Advisory

Track CVE-2018-1712 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2019-4202Ibm api connect os command injection vulnerabilityIBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitra…EPSS 4.2%9.9CVE-2018-1789Ibm api connect server-side request forgery (ssrf) vulnerabilityIBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery atta…EPSS 1.2%9.8CVE-2026-9074Ibm api connect sql injection vulnerabilityIBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset…EPSS 0.51%9.8CVE-2026-3144Ibm api connect vulnerabilityIBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application befor…EPSS 0.41%9.8CVE-2025-13915Ibm api connect vulnerabilityIBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized acce…EPSS 9.0%9.8CVE-2021-29772Ibm api connect code injection vulnerabilityIBM API Connect 5.0.0.0 through 5.0.8.11 could allow a user to potentially inject code due to unsanitized user input. IBM X-Force ID: 202774.EPSS 0.92%9.8CVE-2019-4203Ibm api connect server-side request forgery (ssrf) vulnerabilityIBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from the host OS and potentially …EPSS 1.7%9.8CVE-2019-4155Ibm api connect vulnerabilityIBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect (…EPSS 2.6%

Source: NIST National Vulnerability Database (record CVE-2018-1712), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.