CVE-2018-1890 - Vulnerability Details - OpenCVE

IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081.

No CVSS v4.0

No CVSS v3.1

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00157.

Key SSVC decision points have not yet been added.

Vendors	Products
Ibm	Sdk

Configuration 1 [-]

cpe:2.3:a:ibm:sdk:8.0:*:*:*:java_technology:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2018-12469	IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://www.securityfocus.com/bid/107448
https://exchange.xforce.ibmcloud.com/vulnerabilities/152081
https://nvd.nist.gov/vuln/detail/CVE-2018-1890
https://www.cve.org/CVERecord?id=CVE-2018-1890
https://www.ibm.com/support/docview.wss?uid=ibm10873042
https://www.ibm.com/support/docview.wss?uid=ibm10873332
https://www.ibm.com/support/docview.wss?uid=ibm10874750

History

No history.

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2019-03-11T22:00:00.000Z

Updated: 2025-02-13T16:27:18.602Z

Reserved: 2017-12-13T00:00:00.000Z

Link: CVE-2018-1890

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-03-11T22:29:00.343

Modified: 2024-11-21T04:00:32.843

Link: CVE-2018-1890

Redhat

Severity : Moderate

Publid Date: 2019-03-01T00:00:00Z

Links: CVE-2018-1890 - Bugzilla

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "WebSphere Application Server Patterns", "vendor": "IBM", "versions": [{"status": "affected", "version": "1.0.0.0"}, {"status": "affected", "version": "1.0.0.7"}, {"status": "affected", "version": "2.2.0.0"}, {"status": "affected", "version": "2.2.5.3"}]}, {"product": "WebSphere Application Server", "vendor": "IBM", "versions": [{"status": "affected", "version": "7.0"}, {"status": "affected", "version": "8.0"}, {"status": "affected", "version": "8.5"}, {"status": "affected", "version": "9.0"}, {"status": "affected", "version": "Liberty"}]}, {"product": "Runtimes for Java Technology", "vendor": "IBM", "defaultStatus": "affected"}], "datePublic": "2019-03-01T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081."}], "metrics": [{"cvssV3_0": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "exploitCodeMaturity": "UNPROVEN", "integrityImpact": "LOW", "privilegesRequired": "NONE", "remediationLevel": "OFFICIAL_FIX", "reportConfidence": "CONFIRMED", "scope": "CHANGED", "temporalScore": 4.9, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.0/A:L/AC:H/AV:L/C:L/I:L/PR:N/S:C/UI:N/E:U/RC:C/RL:O", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Gain Privileges", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2024-09-05T03:01:03.000Z", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"name": "ibm-sdk-cve20181890-code-exec(152081)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152081"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873042"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873332"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10874750"}, {"name": "107448", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/107448"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "DATE_PUBLIC": "2019-03-01T00:00:00", "ID": "CVE-2018-1890", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "WebSphere Application Server Patterns", "version": {"version_data": [{"version_value": "1.0.0.0"}, {"version_value": "1.0.0.7"}, {"version_value": "2.2.0.0"}, {"version_value": "2.2.5.3"}]}}, {"product_name": "WebSphere Application Server", "version": {"version_data": [{"version_value": "7.0"}, {"version_value": "8.0"}, {"version_value": "8.5"}, {"version_value": "9.0"}, {"version_value": "Liberty"}]}}, {"product_name": "Runtimes for Java Technology", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "IBM"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081."}]}, "impact": {"cvssv3": {"BM": {"A": "L", "AC": "H", "AV": "L", "C": "L", "I": "L", "PR": "N", "S": "C", "UI": "N"}, "TM": {"E": "U", "RC": "C", "RL": "O"}}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Gain Privileges"}]}]}, "references": {"reference_data": [{"name": "ibm-sdk-cve20181890-code-exec(152081)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152081"}, {"name": "https://www.ibm.com/support/docview.wss?uid=ibm10873042", "refsource": "CONFIRM", "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873042"}, {"name": "https://www.ibm.com/support/docview.wss?uid=ibm10873332", "refsource": "CONFIRM", "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873332"}, {"name": "https://www.ibm.com/support/docview.wss?uid=ibm10874750", "refsource": "CONFIRM", "url": "https://www.ibm.com/support/docview.wss?uid=ibm10874750"}, {"name": "107448", "refsource": "BID", "url": "http://www.securityfocus.com/bid/107448"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T04:14:38.919Z"}, "title": "CVE Program Container", "references": [{"name": "ibm-sdk-cve20181890-code-exec(152081)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152081"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873042"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873332"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10874750"}, {"name": "107448", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/107448"}]}]}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2018-1890", "datePublished": "2019-03-11T22:00:00.000Z", "dateReserved": "2017-12-13T00:00:00.000Z", "dateUpdated": "2025-02-13T16:27:18.602Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:sdk:8.0:*:*:*:java_technology:*:*:*", "matchCriteriaId": "6DEFC54D-3C43-499D-8F5E-75A02E5A1DF2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081."}, {"lang": "es", "value": "IBM SDK, Java Technology Edition, en su versi\u00f3n 8 en la plataforma AIX, utiliza RPATHS absolutas, lo que podr\u00eda facilitar una inyecci\u00f3n de c\u00f3digo y un escalado de privilegios por usuarios locales. IBM X-Force ID: 152081."}], "id": "CVE-2018-1890", "lastModified": "2024-11-21T04:00:32.843", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 1.4, "impactScore": 3.7, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-03-11T22:29:00.343", "references": [{"source": "psirt@us.ibm.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/107448"}, {"source": "psirt@us.ibm.com", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152081"}, {"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873042"}, {"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873332"}, {"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10874750"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/107448"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152081"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873042"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873332"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10874750"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "nvd@nist.gov", "type": "Primary"}]}