CVE-2018-1738 : IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0 could allow an authenticated us

IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0 could allow an authenticated user to obtain highly sensitive information or jeopardize system integrity due to improper authentication mechanisms. IBM X-Force ID: 147907.

Published 2018-10-11 12:29:01

Updated 2019-10-09 23:38:59

Source IBM Corporation

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2018-1738

IBM » Security Key Lifecycle Manager
Versions from including (>=) 2.7.0 and up to, including, (<=) 2.7.0.3
cpe:2.3:a:ibm:security_key_lifecycle_manager:*:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager
Versions from including (>=) 3.0.0 and up to, including, (<=) 3.0.0.1
cpe:2.3:a:ibm:security_key_lifecycle_manager:*:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager
Versions from including (>=) 2.6.0 and up to, including, (<=) 2.6.0.4
cpe:2.3:a:ibm:security_key_lifecycle_manager:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-1738

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 23 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-1738

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:N	8.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
7.1	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N	2.8	4.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: Low Availability: None
7.1	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N	2.8	4.2	IBM Corporation
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: Low Availability: None

CWE ids for CVE-2018-1738

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-1738

http://www.ibm.com/support/docview.wss?uid=ibm10733309

IBM Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Improper Authentication (CVE-2018-1738)
Patch;Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/147907

IBM Security Key Lifecycle Manager improper authentication CVE-2018-1738 Vulnerability Report
VDB Entry;Vendor Advisory

Jump to

Vulnerability Details : CVE-2018-1738

Products affected by CVE-2018-1738

Exploit prediction scoring system (EPSS) score for CVE-2018-1738

CVSS scores for CVE-2018-1738

CWE ids for CVE-2018-1738

References for CVE-2018-1738