CVE-2018-1420

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-10-01 · updated 2026-06-17
Weakness: CWE-732

Description

IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 resets access control settings to the out of the box configuration during Combined Cumulative Fix (CF) installation. This can lead to security miss-configuration of the installation. IBM X-Force ID: 138950.

Affected products

IBM WebSphere Portal: 7.0.0.0, 7.0.0.1, 7.0.0.1-cf011, 7.0.0.1-cf012, 7.0.0.1-cf013, 7.0.0.1-cf014 (+72)

References

http://www.securitytracker.com/id/1041767
https://exchange.xforce.ibmcloud.com/vulnerabilities/138950
https://www.ibm.com/support/docview.wss?uid=swg22014276
http://www.securitytracker.com/id/1041767
https://exchange.xforce.ibmcloud.com/vulnerabilities/138950
https://www.ibm.com/support/docview.wss?uid=swg22014276

Get alerted when CVE-2018-1420 or the next vulnerability affects your stack