CVE-2018-1656: ibm sdk Path Traversal

CVSS: 7.4v3.0HighModified

Published 20-08-2018Last modified 16-09-2024

Vulnerability summary

CVE-2018-1656 is a high (CVSS 7.4) Path Traversal vulnerability in ibm sdk. EPSS estimates a 4.51% chance of exploitation in the next 30 days, higher than 91.4% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.4/10

010

High · v3.0 (CVE.org)

EPSS score

4.51%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 13 · Related 7

RHSA-2018:2568 RHSA-2018:2569 RHSA-2018:2575 RHSA-2018:2576 RHSA-2018:2712 RHSA-2018:2713+7 more

Timeline

20-08-2018
PublishedVulnerability first disclosed.
16-09-2024
Last modifiedVulnerability information updated.

Description

The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.07.4v2.04.3

EPSS trend

Probability

4.51%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

0.00 pp

From 4.51% on 18-09-2026

18-09-202618-10-2026

EPSS score

4.51%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Redhat4 products

Ibm2 products

sdk6.0 | 7.0 | 8.0
sdk, java technology edition6.0 | 7.0 | 8.0

Oracle1 product

enterprise_manager_base_platform13.2.0.0.0 | 13.3.0.0.0

3 vendors · 7 products

References

11 links

www.ibm.com/support/docview.wss?uid=ibm10719653X Refsource CONFIRMVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/144882VDB EntryX Refsource XFVendor Advisory
access.redhat.com/errata/RHSA-2018:2713Vendor AdvisoryX Refsource REDHATThird Party Advisory
www.securityfocus.com/bid/105118VDB EntryX Refsource BIDThird Party Advisory
access.redhat.com/errata/RHSA-2018:2575Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2018:2576Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2018:2568Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2018:2569Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2018:2712Vendor AdvisoryX Refsource REDHATThird Party Advisory
www.securitytracker.com/id/1041765VDB EntryX Refsource SECTRACKThird Party Advisory

Show all 11 references

www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlX Refsource MISCPatchThird Party Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities