What is the CVSS score of CVE-2017-1170?

CVE-2017-1170 has a CVSS 3.0 base score of 5.3 (Medium). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2017-1170?

Yes, a patch is available for CVE-2017-1170. Update the affected software to the latest version immediately.

Websphere Commerce CVE-2017-1170

MEDIUM

2017-04-26 psirt@us.ibm.com

IBM Information Disclosure Websphere Commerce

5.3

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Apr 26, 2017 - 17:59 cve.org

MEDIUM 5.3

DescriptionCVE.org

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session. IBM X-Force ID: 123230.

AnalysisAI

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity.

Technical ContextAI

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session. IBM X-Force ID: 123230. Affected products include: Ibm Websphere Commerce.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Websphere Commerce

View all

CVE-2012-3298 CRITICAL Act Now

10.0 Sep 25

Unspecified vulnerability in the REST services framework in IBM WebSphere Commerce 7.0 Feature Pack 4 allows remote atta

CVE-2016-6090 CRITICAL Act Now

9.8 Feb 01

IBM WebSphere Commerce contains an unspecified vulnerability that could allow disclosure of user personal data, performi

CVE-2015-5007 HIGH This Week

8.8 Jan 15

Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 through 7.0.0.9, and

CVE-2018-1808 HIGH This Week

8.8 Nov 13

IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input contr

CVE-2016-2863 HIGH This Week

8.0 Jul 03

Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 7.0 Feature Pack 8, 8.0.0.x before 8.0.0.10, a

CVE-2017-1569 HIGH This Week

7.5 Oct 03

IBM WebSphere Commerce 7.0 and 8.0 contains an unspecified vulnerability in Marketing ESpot's that could cause a denial

CVE-2015-7397 HIGH This Week

7.4 Jan 10

Multiple open redirect vulnerabilities in the Aurora starter store in IBM WebSphere Commerce 7.0 through Feature Pack 8

CVE-2014-0943 HIGH This Week

7.1 May 25

IBM WebSphere Commerce 6.0 Feature Pack 2 through Feature Pack 5, 7.0.0.0 through 7.0.0.8, and 7.0 Feature Pack 1 throug

CVE-2013-2994 MEDIUM This Month

6.4 Aug 01

IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 incorrectly maintains a valid session after unspecified int

CVE-2015-5008 MEDIUM This Month

6.1 Jan 18

Cross-site scripting (XSS) vulnerability in IBM WebSphere Commerce 6.0 through FP11, 6.0 Feature Pack 4, 7.0 through FP9

CVE-2016-2862 MEDIUM This Month

6.1 Jul 03

Cross-site scripting (XSS) vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 before 7.0.0.9 cumulative i

CVE-2017-1398 MEDIUM This Month

6.1 Jul 10

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

CVE-2017-1170 vulnerability details – vuln.today

Back