CVE-2018-1722 Code injection in Security Access Manager Appliance

What is CVE-2018-1722?

CVE-2018-1722 is a critical code injection vulnerability in IBM Security Access Manager Appliance, published on 24 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Security Access Manager Appliance 9.0.4.0 and 9.0.5.0 could allow remote code execution when Advanced Access Control or Federation services are running. IBM X-Force ID: 147370.

Which versions are affected by CVE-2018-1722?

It affects 1 product.

Products include Ibm Security Access Manager.

How do I fix CVE-2018-1722?

No fix has been published for CVE-2018-1722 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2018-1722 being exploited?

There is no known exploitation of CVE-2018-1722 in the wild and no public exploit code.

Other vulnerabilities in IBM Security Access Manager Appliance

• CVE-2016-3028 Command injection in n/a Critical 9.1
• CVE-2018-1850 Missing authorization in Security Access Manager Appliance High 8.8
• CVE-2016-3025 Security feature bypass in n/a High 8.1
• CVE-2023-30997 IBM Security Access Manager Docker privilege escalation High 7.8
• CVE-2023-30998 IBM Security Access Manager Docker privilege escalation High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f43w-q673-4p3p.