CVE-2018-1890 Code injection in Runtimes for Java Technology
Local attackers can exploit absolute RPATHs in IBM Java SDK on AIX to inject code and elevate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1890?
CVE-2018-1890 is a medium-severity code injection vulnerability in IBM Runtimes for Java Technology, published on 11 Mar 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081.
Weakness: CWE-427
Which versions are affected by CVE-2018-1890?
It affects 1 product.
Products include Ibm Sdk.
How do I fix CVE-2018-1890?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-1890 being exploited?
There is no known exploitation of CVE-2018-1890 in the wild and no public exploit code.
Other vulnerabilities in IBM Runtimes for Java Technology
Sources
Also known as GHSA-qwwq-984w-2342.