IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim…

Description

IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 143744.

Scores

EPSS (exploitation in 30 days)

0.85% · top 42% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.

Weakness

• Cross-Site Scripting
• CWE-20 (opens in a new tab)All about CWE-20 and its CVEs

Affected products

• IBM · API Connect

  • affected 5.0.1.0
  • affected 5.0.0.0
  • affected 5.0.2.0
  • affected 5.0.5.0
  • affected 5.0.6.0
  • affected 5.0.6.1
  • affected 5.0.6.2
  • affected 5.0.7.0
  • affected 5.0.7.1
  • affected 5.0.3.0
  • affected 5.0.4.0
  • affected 5.0.7.2
  • affected 5.0.6.3
  • affected 5.0.6.4
  • affected 5.0.8.0
  • affected 5.0.8.1
  • affected 5.0.6.5
  • affected 5.0.6.6
  • affected 5.0.8.2
  • affected 5.0.8.3

References (2)

• http://www.ibm.com/support/docview.wss?uid=swg22016672 (opens in a new tab)x_refsource_CONFIRMx_transferred
• ibm-api-cve20181599-clickjacking(143744) (opens in a new tab)vdb-entryx_refsource_XFx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2018-1599](https://trackcve.app/badge/CVE-2018-1599.svg)](https://trackcve.app/cve/CVE-2018-1599)

Record last updated 16 Sept 2024, 23:11 UTC.