CVE-2018-1850 Missing authorization in Security Access Manager Appliance

What is CVE-2018-1850?

CVE-2018-1850 is a high-severity missing authorization vulnerability in IBM Security Access Manager Appliance, published on 22 Oct 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM Security Access Manager Appliance 9.0.3.1, 9.0.4.0 and 9.0.5.0 could allow unauthorized administration operations when Advanced Access Control services are running. IBM X-Force ID: 150998.

Which versions are affected by CVE-2018-1850?

It affects 1 product.

Products include Ibm Security Access Manager.

How do I fix CVE-2018-1850?

No fix has been published for CVE-2018-1850 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2018-1850 being exploited?

There is no known exploitation of CVE-2018-1850 in the wild and no public exploit code.

Other vulnerabilities in IBM Security Access Manager Appliance

• CVE-2018-1722 Code injection in Security Access Manager Appliance Critical 10.0
• CVE-2016-3028 Command injection in n/a Critical 9.1
• CVE-2016-3025 Security feature bypass in n/a High 8.1
• CVE-2023-30997 IBM Security Access Manager Docker privilege escalation High 7.8
• CVE-2023-30998 IBM Security Access Manager Docker privilege escalation High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6fgj-x4hm-55cq.