High severity · published Mar 14, 2018
CVE-2018-1437
IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path
7.8
CVSS
2.2%
EPSS
No
On KEV
Description
IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path. A local attacker could exploit this vulnerability to DLL hijacking to execute arbitrary code on the system or cause the application to crash. IBM X-Force ID: 139565.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Notes · Ibm
8.5; 8.5.0.2; 8.5.1; 8.5.1.5; 8.5.2; 8.5.2.4; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1437
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1437
Patch
http://www.ibm.com/support/docview.wss?uid=swg22014201
Third Party Advisory
http://www.securityfocus.com/bid/103401
Third Party Advisory
http://www.securitytracker.com/id/1040563
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/139565
More from Notes
7.8
CVE-2012-6277
Multiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in Symantec Mail Security for Microsoft Exchange before 6.5.8, Symantec Mail Security for…
7.8
CVE-2018-1771
IBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering a buffer overflow in the parsing of command line arguments passed to nsd.exe
7.8
CVE-2018-1435
IBM Notes 8.5 and 9.0 is vulnerable to a DLL hijacking attack
7.8
CVE-2018-1411
IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system
7.8
CVE-2018-1410
IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system