IBM Security Key Lifecycle Manager CVE-2018-1738 Authentication Bypass Vulnerability

Bugtraq ID:	107303
Class:	Input Validation Error
CVE:	CVE-2018-1738
Remote:	Yes
Local:	No
Published:	Sep 28 2018 12:00AM
Updated:	Sep 28 2018 12:00AM
Credit:	IBM X-Force Ethical Hacking Team: Warren Moynihan, Jonathan Fitz-Gerald, John Zuccato, Rodney Ryan, Chris Shepherd, Dmitriy Beryoza
Vulnerable:	IBM Security Key Lifecycle Manager 3.0.0.1 IBM Security Key Lifecycle Manager 3.0 IBM Security Key Lifecycle Manager 2.7.0.3 IBM Security Key Lifecycle Manager 2.7.0.2 IBM Security Key Lifecycle Manager 2.7.0.1 IBM Security Key Lifecycle Manager 2.7 IBM Security Key Lifecycle Manager 2.6.0.4 IBM Security Key Lifecycle Manager 2.6.0.3 IBM Security Key Lifecycle Manager 2.6.0.2 IBM Security Key Lifecycle Manager 2.6.0.1 IBM Security Key Lifecycle Manager 2.6
Not Vulnerable:

IBM Security Key Lifecycle Manager CVE-2018-1738 Authentication Bypass Vulnerability

IBM Security Key Lifecycle Manager is prone to a authentication-bypass vulnerability.

Successfully exploiting this issue will allow attackers to bypass authentication mechanism and perform unauthorized actions; this may aid in launching further attacks.

The following versions are vulnerable:

Security Key Lifecycle Manager 2.6 through 2.6.0.4
Security Key Lifecycle Manager 2.7 through 2.7.0.3
Security Key Lifecycle Manager 3.0 through 3.0.0.1

IBM Security Key Lifecycle Manager CVE-2018-1738 Authentication Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM Security Key Lifecycle Manager CVE-2018-1738 Authentication Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.