CVE-2011-1846

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-05-03 · updated 2026-06-16
Weakness: CWE-264

Description

IBM DB2 9.5 before FP7 and 9.7 before FP4 on Linux, UNIX, and Windows does not properly revoke role membership from groups, which allows remote authenticated users to execute non-DDL statements by leveraging previous inherited possession of a role, a different vulnerability than CVE-2011-0757. NOTE: some of these details are obtained from third party information.

Affected products

IBM Db2 for Linux, UNIX and Windows: through 9.5; through 9.7; 9.5, 9.5-fp1, 9.5-fp2, 9.5-fp2a, 9.5-fp3, 9.5-fp3a (+8)

References

http://secunia.com/advisories/44229
http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IC71263
http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IC71375
http://www-01.ibm.com/support/docview.wss?uid=swg1IC71263
http://www-01.ibm.com/support/docview.wss?uid=swg1IC71375
http://www.securityfocus.com/bid/47525
http://www.vupen.com/english/advisories/2011/1083
https://exchange.xforce.ibmcloud.com/vulnerabilities/66980
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14688
http://secunia.com/advisories/44229
http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IC71263
http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IC71375

Get alerted when CVE-2011-1846 or the next vulnerability affects your stack