CVE-2018-1644

Severity: medium (CVSS 4.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-27 · updated 2026-06-17
Weakness: CWE-200

Description

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 9.0.0.0 - 9.0.0.4, 8.0.0.0 - 8.0.0.19, 8.0.1.0 - 8.0.1.13, 8.0.3.0 - 8.0.3.6, 8.0.4.0 - 8.0.4.14, and 7.0.0.0 Feature Pack 8 could allow an authenticated user to obtain sensitive information about another user.

Affected products

IBM WebSphere Commerce Enterprise: from 8.0.0.0 through 8.0.0.19; from 8.0.1.0 through 8.0.1.13; from 8.0.3.0 through 8.0.3.6; from 8.0.4.0 through 8.0.4.14; from 9.0.0.0 through 9.0.0.4; 7.0-feature_pack_8

References

http://www.ibm.com/support/docview.wss?uid=ibm10728829
https://exchange.xforce.ibmcloud.com/vulnerabilities/144589
http://www.ibm.com/support/docview.wss?uid=ibm10728829
https://exchange.xforce.ibmcloud.com/vulnerabilities/144589

Get alerted when CVE-2018-1644 or the next vulnerability affects your stack