CVE-2017-1534

moderate-risk
Published 2018-01-10

IBM Security Access Manager Appliance 8.0.0 and 9.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 130676.

Do I need to act?

-
0.29% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10 Medium
NETWORK / LOW complexity

Affected Products (20)

Security Access Manager For Web Firmware
Security Access Manager For Web Firmware
Security Access Manager For Web Firmware
Security Access Manager For Web Firmware
Security Access Manager For Web Firmware
Security Access Manager For Web Firmware
Security Access Manager For Web Firmware
Security Access Manager For Web Firmware
Security Access Manager For Web Firmware
Security Access Manager For Web Firmware
Security Access Manager For Web Firmware
Security Access Manager For Web Firmware
Security Access Manager For Mobile
Security Access Manager For Mobile
Security Access Manager For Mobile
Security Access Manager For Mobile
Security Access Manager For Mobile
Security Access Manager For Mobile
Security Access Manager For Mobile
Security Access Manager For Mobile

Affected Vendors

Ibm

References (8)

Vendor Advisory http://www.ibm.com/support/docview.wss?uid=swg22008936
Third Party Advisory http://www.securityfocus.com/bid/102509
Third Party Advisory http://www.securitytracker.com/id/1040169
VDB Entry https://exchange.xforce.ibmcloud.com/vulnerabilities/130676
Vendor Advisory http://www.ibm.com/support/docview.wss?uid=swg22008936
Third Party Advisory http://www.securityfocus.com/bid/102509
Third Party Advisory http://www.securitytracker.com/id/1040169
VDB Entry https://exchange.xforce.ibmcloud.com/vulnerabilities/130676
46
/ 100
moderate-risk
Severity 23/34 · High
Exploitability 1/34 · Minimal
Exposure 22/34 · High