Cross-site scripting in CA API Developer Portal
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
CA API Developer Portal 3.5 up to and including 3.5 CR6 has a stored cross-site scripting vulnerability related to profile picture processing.
Why it matters now
EPSS 0.00877 59th percentileScored 2026-11-07
Fix Fixed CA API Developer Portal (CA Technologies): 3.5 CR7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CA Technologies | CA API Developer Portal | 3.5 to before 3.5 CR7 | 3.5 CR7 | Patch available | CNA |
- CA API Developer Portal VendorCA Technologies Affected 3.5 to before 3.5 CR7 Fixed in 3.5 CR7 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ca:api_developer_portal:3.5:*:*:*:*:*:*:* | 3.5 | Vulnerable | Ca |
| cpe:2.3:a:ca:api_developer_portal:3.5:cr1:*:*:*:*:*:* | 3.5 cr1 | Vulnerable | Ca |
| cpe:2.3:a:ca:api_developer_portal:3.5:cr2:*:*:*:*:*:* | 3.5 cr2 | Vulnerable | Ca |
| cpe:2.3:a:ca:api_developer_portal:3.5:cr3:*:*:*:*:*:* | 3.5 cr3 | Vulnerable | Ca |
| cpe:2.3:a:ca:api_developer_portal:3.5:cr4:*:*:*:*:*:* | 3.5 cr4 | Vulnerable | Ca |
| cpe:2.3:a:ca:api_developer_portal:3.5:cr5:*:*:*:*:*:* | 3.5 cr5 | Vulnerable | Ca |
| cpe:2.3:a:ca:api_developer_portal:3.5:cr6:*:*:*:*:*:* | 3.5 cr6 | Vulnerable | Ca |
- cpe:2.3:a:ca:api_developer_portal:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Ca
- cpe:2.3:a:ca:api_developer_portal:3.5:cr1:*:*:*:*:*:* Versions 3.5 cr1 Vulnerable ·Ca
- cpe:2.3:a:ca:api_developer_portal:3.5:cr2:*:*:*:*:*:* Versions 3.5 cr2 Vulnerable ·Ca
- cpe:2.3:a:ca:api_developer_portal:3.5:cr3:*:*:*:*:*:* Versions 3.5 cr3 Vulnerable ·Ca
- cpe:2.3:a:ca:api_developer_portal:3.5:cr4:*:*:*:*:*:* Versions 3.5 cr4 Vulnerable ·Ca
- cpe:2.3:a:ca:api_developer_portal:3.5:cr5:*:*:*:*:*:* Versions 3.5 cr5 Vulnerable ·Ca
- cpe:2.3:a:ca:api_developer_portal:3.5:cr6:*:*:*:*:*:* Versions 3.5 cr6 Vulnerable ·Ca
Remediation
- Fix · CNA CA API Developer Portal (CA Technologies) Fixed in 3.5 CR7
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
CA API Developer Portal 3.5 CR7
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2018-04854 Cross-site scripting in CA API Developer PortalPriority LOW 29
Timeline
- 2026-10-02 Threatist record created from CVE-2018-6586
- 2026-10-03 Alias added: GHSA-63f6-wj6g-223v
References
More CA Technologies vulnerabilities
- TI-2015-03903 Improper input validation in CA Privileged Access Manager CVSS 3.0CRITICAL 9.8
- TI-2018-11179 Deserialization of untrusted data in CA Technologies Release Automation CVSS 3.0CRITICAL 9.8
- TI-2018-06542 Improper privilege management in CA Privileged Access Manager CVSS 3.1CRITICAL 9.8
- TI-2018-06541 Improper privilege management in CA Privileged Access Manager CVSS 3.1CRITICAL 9.8
- TI-2018-06488 Improper input validation in CA Technologies Workload Control Center CVSS 3.0CRITICAL 9.8
- TI-2019-10262 Improper access control in CA Technologies Client Automation CVSS 3.1CRITICAL 9.8
Sources
- CVE-2018-6586 · CVE Program
- CVE-2018-6586 · NVD
- FIRST EPSS
- GHSA-63f6-wj6g-223v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences