CVE-2018-1640

CWE-20 — Improper Input Validation3 documents3 sources

Severity

8.8HIGH

EPSS

3.0%

top 13.32%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Security Privileged Identity Manager

Timeline

PublishedApr 2

Latest updateMay 13

Description

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 144580.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5ibm/security_privileged_identity_manager2.1.1

▶NVDibm/security_privileged_identity_manager2.1.1

🔴Vulnerability Details

GHSA

GHSA-5r4m-p4mf-4gm4: IBM Security Privileged Identity Manager Virtual Appliance 2↗2022-05-13

▶

CVEList

CVE-2018-1640: IBM Security Privileged Identity Manager Virtual Appliance 2↗2019-04-02

▶