CVE-2018-1890 - OpenCVE

IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081.

No CVSS v4.0

No CVSS v3.1

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:L/AC:L/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ibm	Sdk

Configuration 1 [-]

cpe:2.3:a:ibm:sdk:8.0:*:*:*:java_technology:*:*:*

No data.

References

Link	Providers
http://www.securityfocus.com/bid/107448
https://exchange.xforce.ibmcloud.com/vulnerabilities/152081
https://nvd.nist.gov/vuln/detail/CVE-2018-1890
https://www.cve.org/CVERecord?id=CVE-2018-1890
https://www.ibm.com/support/docview.wss?uid=ibm10873042
https://www.ibm.com/support/docview.wss?uid=ibm10873332
https://www.ibm.com/support/docview.wss?uid=ibm10874750

History

No history.

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2019-03-11T22:00:00Z

Updated: 2024-09-16T23:50:31.052Z

Reserved: 2017-12-13T00:00:00

Link: CVE-2018-1890

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-03-11T22:29:00.343

Modified: 2019-10-09T23:39:17.510

Link: CVE-2018-1890

Redhat

Severity : Moderate

Publid Date: 2019-03-01T00:00:00Z

Links: CVE-2018-1890 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "WebSphere Application Server Patterns", "vendor": "IBM", "versions": [{"status": "affected", "version": "1.0.0.0"}, {"status": "affected", "version": "1.0.0.7"}, {"status": "affected", "version": "2.2.0.0"}, {"status": "affected", "version": "2.2.5.3"}]}, {"product": "WebSphere Application Server", "vendor": "IBM", "versions": [{"status": "affected", "version": "7.0"}, {"status": "affected", "version": "8.0"}, {"status": "affected", "version": "8.5"}, {"status": "affected", "version": "9.0"}, {"status": "affected", "version": "Liberty"}]}, {"product": "Runtimes for Java Technology", "vendor": "IBM", "defaultStatus": "affected"}], "datePublic": "2019-03-01T00:00:00", "descriptions": [{"lang": "en", "value": "IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081."}], "metrics": [{"cvssV3_0": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "exploitCodeMaturity": "UNPROVEN", "integrityImpact": "LOW", "privilegesRequired": "NONE", "remediationLevel": "OFFICIAL_FIX", "reportConfidence": "CONFIRMED", "scope": "CHANGED", "temporalScore": 4.9, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.0/A:L/AC:H/AV:L/C:L/I:L/PR:N/S:C/UI:N/E:U/RC:C/RL:O", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Gain Privileges", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-03-22T12:06:04", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"name": "ibm-sdk-cve20181890-code-exec(152081)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152081"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873042"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873332"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10874750"}, {"name": "107448", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/107448"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "DATE_PUBLIC": "2019-03-01T00:00:00", "ID": "CVE-2018-1890", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "WebSphere Application Server Patterns", "version": {"version_data": [{"version_value": "1.0.0.0"}, {"version_value": "1.0.0.7"}, {"version_value": "2.2.0.0"}, {"version_value": "2.2.5.3"}]}}, {"product_name": "WebSphere Application Server", "version": {"version_data": [{"version_value": "7.0"}, {"version_value": "8.0"}, {"version_value": "8.5"}, {"version_value": "9.0"}, {"version_value": "Liberty"}]}}, {"product_name": "Runtimes for Java Technology", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "IBM"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081."}]}, "impact": {"cvssv3": {"BM": {"A": "L", "AC": "H", "AV": "L", "C": "L", "I": "L", "PR": "N", "S": "C", "UI": "N"}, "TM": {"E": "U", "RC": "C", "RL": "O"}}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Gain Privileges"}]}]}, "references": {"reference_data": [{"name": "ibm-sdk-cve20181890-code-exec(152081)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152081"}, {"name": "https://www.ibm.com/support/docview.wss?uid=ibm10873042", "refsource": "CONFIRM", "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873042"}, {"name": "https://www.ibm.com/support/docview.wss?uid=ibm10873332", "refsource": "CONFIRM", "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873332"}, {"name": "https://www.ibm.com/support/docview.wss?uid=ibm10874750", "refsource": "CONFIRM", "url": "https://www.ibm.com/support/docview.wss?uid=ibm10874750"}, {"name": "107448", "refsource": "BID", "url": "http://www.securityfocus.com/bid/107448"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T04:14:38.919Z"}, "title": "CVE Program Container", "references": [{"name": "ibm-sdk-cve20181890-code-exec(152081)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152081"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873042"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873332"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10874750"}, {"name": "107448", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/107448"}]}]}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2018-1890", "datePublished": "2019-03-11T22:00:00Z", "dateReserved": "2017-12-13T00:00:00", "dateUpdated": "2024-09-16T23:50:31.052Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:sdk:8.0:*:*:*:java_technology:*:*:*", "matchCriteriaId": "6DEFC54D-3C43-499D-8F5E-75A02E5A1DF2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081."}, {"lang": "es", "value": "IBM SDK, Java Technology Edition, en su versi\u00f3n 8 en la plataforma AIX, utiliza RPATHS absolutas, lo que podr\u00eda facilitar una inyecci\u00f3n de c\u00f3digo y un escalado de privilegios por usuarios locales. IBM X-Force ID: 152081."}], "id": "CVE-2018-1890", "lastModified": "2019-10-09T23:39:17.510", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 1.4, "impactScore": 3.7, "source": "psirt@us.ibm.com", "type": "Secondary"}]}, "published": "2019-03-11T22:29:00.343", "references": [{"source": "psirt@us.ibm.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/107448"}, {"source": "psirt@us.ibm.com", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152081"}, {"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873042"}, {"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10873332"}, {"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10874750"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "nvd@nist.gov", "type": "Primary"}]}