High severity · published Aug 1, 2018
CVE-2018-1595
IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to improper handling of user supplied input
8.8
CVSS
2.4%
EPSS
No
On KEV
Description
IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to improper handling of user supplied input. IBM X-Force ID: 143622.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Spectrum Symphony · IBM
7.2.0.2; 7.1.2 · source: vendor, NVD
PS
Platform Symphony · Ibm
6.1.1; 7.1.0; 7.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1595
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1595
Third Party Advisory
http://www.securityfocus.com/bid/104956
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/143622
Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=isg3T1027819
More from Spectrum Symphony
7.1
CVE-2018-1702
IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data
6.5
CVE-2018-1705
IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 contain an information disclosure vulnerability that could allow an authenticated…
6.1
CVE-2023-24975
IBM Spectrum Symphony 7.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers
5.4
CVE-2018-1706
IBM Spectrum Symphony 7.2.0.2 is vulnerable to cross-site scripting
5.4
CVE-2018-1704
IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack