{"api_version":"1","generated_at":"2026-07-23T06:44:38+00:00","cve":"CVE-2018-1813","urls":{"html":"https://cve.report/CVE-2018-1813","api":"https://cve.report/api/cve/CVE-2018-1813.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-1813","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-1813"},"summary":{"title":"CVE-2018-1813","description":"IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 150017.","state":"PUBLIC","assigner":"psirt@us.ibm.com","published_at":"2018-12-13 16:29:00","updated_at":"2019-10-09 23:39:00"},"problem_types":["NVD-CWE-noinfo"],"metrics":[],"references":[{"url":"http://www.ibm.com/support/docview.wss?uid=ibm10787785","name":"http://www.ibm.com/support/docview.wss?uid=ibm10787785","refsource":"CONFIRM","tags":["Patch","Vendor Advisory"],"title":"Security Bulletin: Multiple Security vulnerabilities have been fixed in the IBM Security Access Manager Appliance","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/150017","name":"ibm-sam-cve20181813-input-validation(150017)","refsource":"XF","tags":["VDB Entry","Vendor Advisory"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1813","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1813","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"1813","vulnerable":"1","versionEndIncluding":"9.0.5.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"security_access_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","DATE_PUBLIC":"2018-12-11T00:00:00","ID":"CVE-2018-1813","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Security Access Manager Appliance","version":{"version_data":[{"version_value":"9.0.1.0"},{"version_value":"9.0.2.0"},{"version_value":"9.0.3.0"},{"version_value":"9.0.4.0"},{"version_value":"9.0.5.0"}]}}]},"vendor_name":"IBM"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 150017."}]},"impact":{"cvssv3":{"BM":{"A":"N","AC":"L","AV":"N","C":"N","I":"L","PR":"L","S":"U","SCORE":"4.300","UI":"N"},"TM":{"E":"U","RC":"C","RL":"O"}}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Gain Access"}]}]},"references":{"reference_data":[{"name":"http://www.ibm.com/support/docview.wss?uid=ibm10787785","refsource":"CONFIRM","url":"http://www.ibm.com/support/docview.wss?uid=ibm10787785"},{"name":"ibm-sam-cve20181813-input-validation(150017)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/150017"}]}},"nvd":{"publishedDate":"2018-12-13 16:29:00","lastModifiedDate":"2019-10-09 23:39:00","problem_types":["NVD-CWE-noinfo"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:security_access_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.1.0","versionEndIncluding":"9.0.5.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"1813","Ordinal":"117337","Title":"CVE-2018-1813","CVE":"CVE-2018-1813","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"1813","Ordinal":"1","NoteData":"IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 150017.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"1813","Ordinal":"2","NoteData":"2018-12-13","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"1813","Ordinal":"3","NoteData":"2018-12-13","Type":"Other","Title":"Modified"}]}}}