CVE-2018-1901

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to temporarily gain elevated privileges on the system, caused by incorrect cached value being used. IBM X-Force ID: 152530.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
IBM	WebSphere Application Server	8.5; 9.0; Liberty

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/152530VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10738727Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/152530VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10738727Patch, Vendor Advisory

Timeline

Published: Dec 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-190106.5Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. A CVE-2018-190118.8CX-Supervisor (Versions 3.42 and prior) can execute code that has been injected into a project file. An attacker could exploit this to execu CVE-2018-190127.8Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. V CVE-2018-190135.0An attacker could inject commands to delete files and/or delete the contents of a file on CX-Supervisor (Versions 3.42 and prior) through a CVE-2018-190146.5Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. L CVE-2018-190157.3An attacker could inject commands to launch programs and create, write, and read files on CX-Supervisor (Versions 3.42 and prior) through a CVE-2018-190167.5Rockwell Automation EtherNet/IP Web Server Modules 1756-EWEB (includes 1756-EWEBK) Version 5.001 and earlier, and CompactLogix 1768-EWEB Ver CVE-2018-190178.8Several use after free vulnerabilities have been identified in CX-Supervisor (Versions 3.42 and prior). When processing project files, the a CVE-2018-190187.3An access of uninitialized pointer vulnerability in CX-Supervisor (Versions 3.42 and prior) could lead to type confusion when processing pro CVE-2018-190197.3A type confusion vulnerability exists when processing project files in CX-Supervisor (Versions 3.42 and prior). An attacker could use a spec CVE-2018-19024.3IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to spoof connection information which could be used to CVE-2018-190205.0When CX-Supervisor (Versions 3.42 and prior) processes project files and tampers with the value of an offset, an attacker can force the appl