« Volver al listado

CVE-2018-8892

Estado: ModificadaMedia (6.5)—

A cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to make modifications to the UEM settings in the context of a Management Console administrator.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Blackberry — Unified Endpoint Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-8892",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@blackberry.com",
      "affectedData": [
        {
          "vendor": "BlackBerry",
          "product": "BlackBerry UEM",
          "versions": [
            {
              "status": "affected",
              "version": "12.9.0 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-12-20T20:29:00.480",
  "references": [
    {
      "url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000054162",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "secure@blackberry.com"
    },
    {
      "url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000054162",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to make modifications to the UEM settings in the context of a Management Console administrator."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad Cross-Site Request Forgery (CSRF) en la consola de gestión de BlackBerry UEM, en versiones anteriores a la 12.9.1, podría permitir que un atacante modifique las opciones de UEM en el contexto de un administrador de la consola."
    }
  ],
  "lastModified": "2026-06-17T02:05:35.713",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0AFB64F-41FB-4D16-98BA-40F5F7B95C5E",
              "versionEndExcluding": "12.9.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@blackberry.com"
}