CVE-2018-1551

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have more authority than they should have if an MQ administrator creates an invalid user group name. IBM X-Force ID: 142888.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
IBM	WebSphere MQ	8.0.0.2; 8.0.0.4; 8.0.0.3; 8.0.0.6; 8.0.0.5; 8.0.0.7; 8.0.0.8; 9.0.0.0; 9.0.0.1; 9.0.0.2; 9.0.0.3

References

http://www.securityfocus.com/bid/105040Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/142888VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10716113Vendor Advisory
http://www.securityfocus.com/bid/105040Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/142888VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10716113Vendor Advisory

Timeline

Published: Aug 6, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-155106.1Cross-site scripting (XSS) vulnerability in the 'Certificate' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitr CVE-2018-155116.1Cross-site scripting (XSS) vulnerability in the 'Notification template' feature of totemomail 6.0.0 build 570 allows remote attackers to inj CVE-2018-155126.1Cross-site scripting (XSS) vulnerability in the 'Authorisation Service' feature of totemomail 6.0.0 build 570 allows remote attackers to inj CVE-2018-155135.3Log viewer in totemomail 6.0.0 build 570 allows access to sessionIDs of high privileged users by leveraging access to a read-only auditor ro CVE-2018-155148.8HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce-win72 (stable) deserialized requests over CVE-2018-155157.8The CaptivelPortal service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices will load a Trojan horse "quserex.dll" from the Captivel CVE-2018-155165.8The FTP service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices allows remote attackers to conduct a PORT command bounce scan via p CVE-2018-155178.6The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but act CVE-2018-155188.8QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document.CVE-2018-155199.8Various Lexmark devices have a Buffer Overflow (issue 1 of 2).CVE-2018-15528.8IBM Robotic Process Automation with Automation Anywhere 10.0 and 11.0 allows a remote attacker to execute arbitrary code on the system, caus CVE-2018-155209.8Various Lexmark devices have a Buffer Overflow (issue 2 of 2).