CVE-2018-9021

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary commands with specially crafted requests.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

VendorProductVersions
CA TechnologiesCA Privileged Access Manager2.8.2 and earlier

References

Timeline

Published
Jun 18, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-90229.8An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary code oCVE-2018-90238.8An input validation vulnerability in CA Privileged Access Manager 2.x allows unprivileged users to execute arbitrary commands by passing speCVE-2018-90245.3An improper authentication vulnerability in CA Privileged Access Manager 2.x allows attackers to spoof IP addresses in a log file.CVE-2018-90257.5An input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to poison log files with specially crafted inpCVE-2018-90267.5A session fixation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to hijack user sessions with a specially crafteCVE-2018-90276.1A reflected cross-site scripting vulnerability in CA Privileged Access Manager 2.x allows remote attackers to execute malicious script with CVE-2018-90287.5Weak cryptography used for passwords in CA Privileged Access Manager 2.x reduces the complexity for password cracking.CVE-2018-90299.8An improper input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to conduct SQL injection attacks.CVE-2018-90319.8The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "if(pwd ==" line in the HTML soCVE-2018-90329.8An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Version : A1, B1; FirmwarCVE-2018-90345.4Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote attackers to injectCVE-2018-90359.6CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote at
CVE-2018-9021: Critical severity, CVSS 9.8 | Vulnix