{"affected":[{"affectedData":[{"product":"WebSphere Commerce Enterprise","vendor":"IBM","versions":[{"status":"affected","version":"V7"},{"status":"affected","version":"V8"},{"status":"affected","version":"V9"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:websphere_commerce:*:*:*:*:*:*:*:*","matchCriteriaId":"18F5428C-2F2C-4FA1-95B8-C6518461BD62","versionEndIncluding":"8.0.0.19","versionStartIncluding":"8.0.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:websphere_commerce:*:*:*:*:*:*:*:*","matchCriteriaId":"A6351FC8-9F02-4ADA-9C99-BE10501B40EB","versionEndIncluding":"8.0.1.13","versionStartIncluding":"8.0.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:websphere_commerce:*:*:*:*:*:*:*:*","matchCriteriaId":"DF06DB82-B1D8-4A67-A9A2-5DF1139F95B9","versionEndIncluding":"8.0.3.6","versionStartIncluding":"8.0.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:websphere_commerce:*:*:*:*:*:*:*:*","matchCriteriaId":"0FDED80B-0CF5-4482-8312-1A85672E74F6","versionEndIncluding":"8.0.4.17","versionStartIncluding":"8.0.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:websphere_commerce:*:*:*:*:*:*:*:*","matchCriteriaId":"5A019F3D-55DD-47C1-89E1-E74BFBA5EAD1","versionEndIncluding":"9.0.0.6","versionStartIncluding":"9.0.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:websphere_commerce:7.0.0.9:*:*:*:*:*:*:*","matchCriteriaId":"66F86968-8BD4-42D0-A5C5-9685E3287D01","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM WebSphere Commerce Enterprise V7, V8, and V9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 142596."},{"lang":"es","value":"IBM WebSphere Commerce Enterprise V7, V8 y V9 es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades previstas. Esto podría dar lugar a una revelación de credenciales en una sesión de confianza. IBM X-Force ID: 142596."}],"id":"CVE-2018-1541","lastModified":"2026-06-17T01:51:23.940","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"LOW","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":3.5,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":6.8,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":true}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2018-10-24T12:29:00.260","references":[{"source":"psirt@us.ibm.com","tags":["Third Party Advisory","VDB Entry"],"url":"http://www.securityfocus.com/bid/105744"},{"source":"psirt@us.ibm.com","tags":["VDB Entry","Vendor Advisory"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/142596"},{"source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"],"url":"https://www.ibm.com/support/docview.wss?uid=ibm10731225"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"url":"http://www.securityfocus.com/bid/105744"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["VDB Entry","Vendor Advisory"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/142596"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"url":"https://www.ibm.com/support/docview.wss?uid=ibm10731225"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"nvd@nist.gov","type":"Primary"}]}