CVE-2018-8888 Cross-site scripting in BlackBerry UEM
Stored XSS in BlackBerry UEM Management Console allows attackers to execute scripts in admin sessions, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-8888?
CVE-2018-8888 is a medium-severity cross-site scripting vulnerability in BlackBerry UEM, published on 20 Dec 2018. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A stored cross-site scripting (XSS) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.10.0 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator.
Weakness: CWE-79
Which versions are affected by CVE-2018-8888?
It affects 1 product.
Products include Blackberry Unified Endpoint Manager.
How do I fix CVE-2018-8888?
No fix has been published for CVE-2018-8888 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-8888 being exploited?
There is no known exploitation of CVE-2018-8888 in the wild and no public exploit code.
Other vulnerabilities in BlackBerry UEM
- CVE-2026-18084 Cross-Site Scripting (XSS) in Management Console of BlackBerry UEM
- CVE-2018-8890 Information disclosure in UEM
- CVE-2018-8892 Cross-site request forgery in BlackBerry UEM
- CVE-2017-17442 Cross-site scripting in UEM Management Console
- CVE-2026-18085 Improper Input Validation Leads to Arbitrary File Download and Potential Denial of Service in BlackBerry UEM
Sources
Also known as GHSA-6mxf-mv9r-942p.