High severity · published Mar 11, 2019
CVE-2018-1890
IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users
7.8
CVSS
0.5%
EPSS
No
On KEV
Description
IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Runtimes for Java Technology · IBM
All versions, or not specified · source: vendor
WA
WebSphere Application Server · IBM
7.0; 8.0; 8.5; 9.0; Liberty · source: vendor
WA
WebSphere Application Server Patterns · IBM
1.0.0.0; 1.0.0.7; 2.2.0.0; 2.2.5.3 · source: vendor
SD
Sdk · Ibm
8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1890
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1890
Third Party Advisory
http://www.securityfocus.com/bid/107448
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/152081
Patch
https://www.ibm.com/support/docview.wss?uid=ibm10873042
Patch
https://www.ibm.com/support/docview.wss?uid=ibm10873332
Patch
https://www.ibm.com/support/docview.wss?uid=ibm10874750
More from Runtimes for Java Technology
–
CVE-2011-0311
The class file parser in IBM Java before 1.4.2 SR13 FP9, as used in IBM Runtimes for Java Technology 5.0.0 before SR13 and 6.0.0 before SR10, allows remote authenticated users to…
–
CVE-2009-3852
Unspecified vulnerability in the XML component in IBM Runtimes for Java Technology 5.0.0 before SR10 has unknown impact and attack vectors, related to the "updated version of…