CVE-2018-1968 Information disclosure in Security Identity Manager

What is CVE-2018-1968?

CVE-2018-1968 is a medium-severity vulnerability in IBM Security Identity Manager, published on 11 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153749.

Weakness: CWE-200

Which versions are affected by CVE-2018-1968?

It affects 1 product.

Products include Ibm Security Identity Manager Virtual Appliance.

How do I fix CVE-2018-1968?

No fix has been published for CVE-2018-1968 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-1968 being exploited?

There is no known exploitation of CVE-2018-1968 in the wild and no public exploit code.

Other vulnerabilities in IBM Security Identity Manager

• CVE-2016-0332 Security feature bypass in n/a Critical 9.8
• CVE-2016-0324 Command injection in n/a High 8.8
• CVE-2016-0327 Privilege escalation in n/a High 7.8
• CVE-2019-4676 Information disclosure in Security Identity Manager Virtual Appliance Medium 6.3
• CVE-2016-9704 Cross-site scripting in Identity Manager Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5wm4-cj27-w4cv.