CVE-2018-1000628

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-28 · updated 2026-06-17

Description

Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions, caused by the direct checking of the API key against a user-supplied value in PHP's GET global variable array using PHP's strcmp() function. By adding "[]" to the end of "key" in the URL when accessing API functions, an attacker could exploit this vulnerability to execute API functions.

Affected products

Battelle V2I Hub: 2.5.1

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/147305
https://exchange.xforce.ibmcloud.com/vulnerabilities/147305

Get alerted when CVE-2018-1000628 or the next vulnerability affects your stack