CVE-2018-1904 IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through an administrative client class with a serialized object from untrusted sourc...
CriticalCVSS 9.8
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through an administrative client class with a serialized object from untrusted sources. IBM X-Force ID: 152533.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm websphere application server | >= 7.0.0.0, <= 7.0.0.45 | No fix listed |
| ibm websphere application server | >= 8.0.0.0, <= 8.0.0.15 | No fix listed |
| ibm websphere application server | >= 8.5.0.0, <= 8.5.5.14 | No fix listed |
| ibm websphere application server | >= 9.0.0.0, <= 9.0.0.9 | No fix listed |
| ibm websphere application server | = 7.0 | No fix listed |
| ibm websphere application server | = 8.0 | No fix listed |
| ibm websphere application server | = 8.5 | No fix listed |
| ibm websphere application server | = 9.0 | No fix listed |
References
- 106193 third-party-advisory vdb-entry
- ibm-websphere-cve20181904-code-exec(152533) vdb-entry vendor-advisory
- www-01.ibm.com patch vendor-advisory