PT-2018-12347 · Ibm · Ibm Websphere Portal

Published 2018-10-01 · Updated 2019-10-09 · CVE-2018-1420

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions 7.0 through 9.0

Description The issue concerns a security miss-configuration that occurs during the installation of Combined Cumulative Fix (CF) in IBM WebSphere Portal, where access control settings are reset to their out-of-the-box configuration.

Recommendations For versions 7.0 through 9.0, after installing the Combined Cumulative Fix, manually review and reapply the necessary access control settings to ensure the security configuration is properly set up.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2018-1420

Affected Products

Ibm Websphere Portal

References · 5

• https://osv.dev/vulnerability/CVE-2018-1420 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1420 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/138950 · Vendor Advisory
• https://ibm.com/support/docview.wss?uid=swg22014276 · Vendor Advisory
• http://securitytracker.com/id/1041767 · Note