CVE-2018-1626low

CVE-2018-1626: low-severity vulnerability in IBM Security Privileged Identity Manager

Published · Updated

Follow this CVE+ Monitor Security Privileged Identity Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.1epss 1.1%
IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 144411.
CVSS:3.0/A:N/I:N/AC:H/S:U/PR:L/UI:N/C:L/AV:N/RC:C/RL:O/E:U
Affected products
IBM · Security Privileged Identity Manager
Related CVEs — IBM Security Privileged Identity Manager

In the same product, most dangerous first.

CVE-2018-1640HIGHCVE-2018-1640EPSS 3.6%CVE-2018-1618HIGHCVE-2018-1618EPSS 3.4%CVE-2018-1680MEDIUMCVE-2018-1680EPSS 1.5%CVE-2016-5959—CVE-2016-5959EPSS 1.3%CVE-2017-1705MEDIUMCVE-2017-1705EPSS 1.2%CVE-2018-1625MEDIUMCVE-2018-1625EPSS 1.0%