CVE-2018-1469

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

IBM API Connect Developer Portal 5.0.0.0 through 5.0.8.2 could allow an unauthenticated attacker to execute system commands using specially crafted HTTP requests. IBM X-Force ID: 140605.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
IBMAPI Connect5.0.1.0; 5.0.0.0; 5.0.2.0; 5.0.5.0; 5.0.6.0; 5.0.6.1; 5.0.6.2; 5.0.7.0; 5.0.7.1; 5.0.3.0; 5.0.4.0; 5.0.7.2; 5.0.6.3; 5.0.6.4; 5.0.8.0; 5.0.8.1; 5.0.6.5; 5.0.6.6; 5.0.8.2

References

Timeline

Published
Apr 4, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-146906.1An issue was discovered in Subsonic 6.1.1. The general settings are affected by two stored cross-site scripting vulnerabilities in the titleCVE-2018-146916.1An issue was discovered in Subsonic 6.1.1. The music tags feature is affected by three stored cross-site scripting vulnerabilities in the c0CVE-2018-146957.5Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers toCVE-2018-146967.5Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers toCVE-2018-146976.1Cross-site scripting in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScrCVE-2018-146986.1Cross-site scripting in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScrCVE-2018-146999.8System command injection in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackerCVE-2018-14704.3IBM Sterling File Gateway 2.2.0 through 2.2.6 could allow a remote authenticated attacker to obtain sensitive information displayed in the UCVE-2018-147007.5Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers CVE-2018-147019.8System command injection in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackerCVE-2018-147027.5Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackersCVE-2018-147039.8Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attacker
CVE-2018-1469: Critical severity, CVSS 9.8 | Vulnix