Login Request a demo
High severity · published Feb 21, 2019
CVE-2018-1946
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and allows those actors to negotiate which…
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. IBM X-Force ID: 153388.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Security Identity Governance and Intelligence · IBM
5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; +3 more · source: vendor, NVD
Affected product
SI
Security Identity Governance and Intelligence
IBM
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1946
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1946
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/153388
Patch
https://www.ibm.com/support/docview.wss?uid=ibm10872142
More from Security Identity Governance and Intelligence
9.8
CVE-2020-4958
IBM Security Identity Governance and Intelligence 5.2.6 does not perform any authentication for functionality that requires a provable user identity or consumes a significant…
9.8
CVE-2018-1944
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for…
8.8
CVE-2017-1407
IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the system
8.6
CVE-2017-1483
IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected…
8.2
CVE-2020-4795
IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information to an unauthorized user using a specially crafted HTTP request