CVE-2018-1840
published 2018-12-03CVE-2018-1840: IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to gain elevated privileges on the system, caused when a security domain is…
PriorityP345high8.1CVSS 3.0
AVNACHPRNUINSUCHIHAH
EPSS
2.14%
80.1th percentile
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to gain elevated privileges on the system, caused when a security domain is configured to use a federated repository other than global federated repository and then migrated to a newer release of WebSphere Application Server. IBM X-Force ID: 150813.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | 8.5.0.0 – 8.5.5.14 | — |
| ibm | websphere_application_server | 9.0.0.0 – 9.0.0.9 | — |
CVSS provenance
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
ghsa6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
OpenRefine vulnerable to zip slip in project import
ghsa·2023-07-18·CVSS 6.5
CVE-2023-37476 [MEDIUM] CWE-22 OpenRefine vulnerable to zip slip in project import
OpenRefine vulnerable to zip slip in project import
### Impact
A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution if a user can be convinced to import it.
### Patches
The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible.
### Workarounds
Only import OpenRefine projects from trusted sources.
### References
A similar [issue](https://github.com/OpenRefine/OpenRefine/issues/1840) existed in the Create Project feature ([CVE-2018-19859](https://nvd.nist.gov/vuln/detail/CVE-2018-19859)), which was fixed by PR [#1901](https://github.com/OpenRefine/OpenRefine/pull/1901).
GHSA
GHSA-7h78-rcqp-p8wh: IBM WebSphere Application Server 8
ghsa_unreviewed·2022-05-13
CVE-2018-1840 [HIGH] CWE-668 GHSA-7h78-rcqp-p8wh: IBM WebSphere Application Server 8
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to gain elevated privileges on the system, caused when a security domain is configured to use a federated repository other than global federated repository and then migrated to a newer release of WebSphere Application Server. IBM X-Force ID: 150813.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/106141https://exchange.xforce.ibmcloud.com/vulnerabilities/150813https://www.ibm.com/support/docview.wss?uid=ibm10735767http://www.securityfocus.com/bid/106141https://exchange.xforce.ibmcloud.com/vulnerabilities/150813https://www.ibm.com/support/docview.wss?uid=ibm10735767
2018-12-03
Published