PT-2018-13700 · Ibm · Ibm Websphere Portal

Published 2018-10-01 · Updated 2019-10-09 · CVE-2018-1672

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions 7.0 through 9.0

Description The issue arises from the software's failure to set the correct user context in certain impersonation scenarios, allowing a user to act with the identity of a different user.

Recommendations For versions 7.0 through 9.0, update to a version that includes the fix for this issue to prevent unauthorized user impersonation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-1672

Affected Products

Ibm Websphere Portal

References · 5

• https://osv.dev/vulnerability/CVE-2018-1672 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1672 · Security Note
• https://ibm.com/support/docview.wss?uid=ibm10716981 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/144958 · Vendor Advisory
• http://securitytracker.com/id/1041766 · Note