← Vulnerability feed

Vulnerability record · CVE-2018-1712 · published 16 August 2018

CVE-2018-1712: Ibm api connect cross-site request forgery vulnerability

Ibm · Api Connect

IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input parameters can trick the server into making potentially malicious calls within the trusted network. IBM X-Force ID: 146370.

9.9 CVSS 3.0 Critical EPSS 0.71% · top 45.9% CWE-352 · Cross-site request forgery
9.9CVSS 3.0 base score, v2 7.5
0.71%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input parameters can trick the server into making potentially malicious calls within the trusted network. IBM X-Force ID: 146370.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://exchange.xforce.ibmcloud.com/vulnerabilities/146370 VDB EntryVendor Advisory
https://www-01.ibm.com/support/docview.wss?uid=ibm10716169 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/146370 VDB EntryVendor Advisory
https://www-01.ibm.com/support/docview.wss?uid=ibm10716169 Vendor Advisory

Track CVE-2018-1712 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2019-4202Ibm api connect os command injection vulnerabilityIBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitra…EPSS 4.2%9.9CVE-2026-17150Ibm api connect vulnerabilityIBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and ac…EPSS 0.80%9.9CVE-2026-17049Ibm api connect insecure direct object reference vulnerabilityIBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify arbitrary documents …EPSS 0.51%9.9CVE-2026-16884Ibm api connect xml external entity (xxe) vulnerabilityIBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.EPSS 0.50%9.9CVE-2026-16920Ibm api connect vulnerabilityIBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy vulner…EPSS 0.50%9.9CVE-2018-1789Ibm api connect server-side request forgery (ssrf) vulnerabilityIBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery atta…EPSS 1.2%9.8CVE-2026-17301Ibm api connect improper verification of cryptographic signature vulnerabilityIBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass authentication due to impr…EPSS 0.41%9.8CVE-2026-16720Ibm api connect improper authentication vulnerabilityIBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users …EPSS 0.77%

Source: NIST National Vulnerability Database (record CVE-2018-1712), CISA KEV, FIRST EPSS (scores of 2026-11-11). This page is refreshed as NVD updates the record.