← Vulnerability feed

Vulnerability record · CVE-2018-1789 · published 7 September 2018

CVE-2018-1789: Ibm api connect server-side request forgery (ssrf) vulnerability

Ibm · Api Connect

IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack. IBM X-Force ID: 148939.

9.9 CVSS 3.0 Critical EPSS 1.2% · top 32.3% CWE-918 · Server-side request forgery (SSRF)
9.9CVSS 3.0 base score, v2 6.5
1.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack. IBM X-Force ID: 148939.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://exchange.xforce.ibmcloud.com/vulnerabilities/148939 VDB EntryVendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10728517 PatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/148939 VDB EntryVendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10728517 PatchVendor Advisory

Track CVE-2018-1789 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2019-4202Ibm api connect os command injection vulnerabilityIBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitra…EPSS 4.2%9.9CVE-2018-1712Ibm api connect cross-site request forgery vulnerabilityIBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input p…EPSS 0.71%9.8CVE-2026-9074Ibm api connect sql injection vulnerabilityIBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset…EPSS 0.51%9.8CVE-2026-3144Ibm api connect vulnerabilityIBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application befor…EPSS 0.41%9.8CVE-2025-13915Ibm api connect vulnerabilityIBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized acce…EPSS 9.0%9.8CVE-2021-29772Ibm api connect code injection vulnerabilityIBM API Connect 5.0.0.0 through 5.0.8.11 could allow a user to potentially inject code due to unsanitized user input. IBM X-Force ID: 202774.EPSS 0.92%9.8CVE-2019-4203Ibm api connect server-side request forgery (ssrf) vulnerabilityIBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from the host OS and potentially …EPSS 1.7%9.8CVE-2019-4155Ibm api connect vulnerabilityIBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect (…EPSS 2.6%

Source: NIST National Vulnerability Database (record CVE-2018-1789), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.