CVE-2018-1618: Path Traversal

Published Apr 2, 2019

Updated

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 144343.

Affected Software

1 affected component

IBM Security Privileged Identity Manager=2.1.1

Event History

Apr 2, 2019

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2018-1618?

CVE-2018-1618 has a medium severity rating due to the potential for unauthorized file access.

How do I fix CVE-2018-1618?

To fix CVE-2018-1618, upgrade IBM Security Privileged Identity Manager to the latest version available.

What types of attacks are possible with CVE-2018-1618?

CVE-2018-1618 allows remote attackers to perform directory traversal attacks to access sensitive files.

Is my version affected by CVE-2018-1618?

Versions of IBM Security Privileged Identity Manager prior to 2.2.1 are affected by CVE-2018-1618.

How can I mitigate risks associated with CVE-2018-1618?

Mitigation strategies for CVE-2018-1618 include restricting access to the application and applying the recommended patches.