IBM Security Bulletin: Security Misconfiguration during Combined Cumulative Fix Installation Affects IBM WebSphere Portal (CVE-2018-1420)

Sep 28, 2018 9:00 am EDT

Categorized: Medium Severity

Share this post:

IBM WebSphere Portal resets access control settings to the out of the box configuration during Combined Cumulative Fix (CF) installation. This can lead to security miss-configuration of the installation (CVE-2018-1420).

CVE(s): CVE-2018-1420

Affected product(s) and affected version(s):

Affected Product	Affected Versions
IBM WebSphere Portal	9.0.0.0 – 9.0.0.0 CF15
IBM WebSphere Portal	8.5.0.0 – 8.5.0.0 CF15
IBM WebSphere Portal	8.0.0.0 – 8.0.0.1 CF22
IBM WebSphere Portal	7.0.0.0 – 7.0.0.2 CF30

For unsupported versions IBM recommends upgrading to a fixed, supported version of the product.

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: https://www-01.ibm.com/support/docview.wss?uid=swg22014276
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/138950

from IBM Product Security Incident Response Team https://ift.tt/2zCeQWx