CVE-2018-1639

MEDIUM

The Report Builder of Jazz Reporting Service 5.0 through 5.0.2 and 6.0 through 6.0.6 could allow an authenticated user to obtain sensitive information beyond its assigned privileges. IBM X-Force ID...

Affects 1 product across 1 vendor.

CVSS 3.06.5
EPSS1.1%
Percentile64th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, no integrity impact, no availability impact.
CWE Weakness Definitions
CWE-200: Exposure of Sensitive Information

Application reveals restricted data such as system internals, credentials, or user data to unauthorized actors.

Related Attack Patterns (CAPEC)
CAPEC-13 Subverting Environment Variable Values
via CWE-200
CAPEC-59 Session Credential Falsification through Prediction
via CWE-200
CAPEC-60 Reusing Session IDs (aka Session Replay)
via CWE-200
CAPEC-79 Using Slashes in Alternate Encoding
via CWE-200
CAPEC-285 ICMP Echo Request Ping
via CWE-200
Show all 59

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2018. A medium severity vulnerability affects Ibm systems (CVE-2018-1639). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2018-GLOBAL-216772-M • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2018-1639?
This vulnerability was disclosed in 2018. A medium severity vulnerability affects Ibm systems (CVE-2018-1639). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2018-1639?
CVE-2018-1639 has CVSS 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS: 1.1%.
Is CVE-2018-1639 actively exploited?
No confirmed active exploitation of CVE-2018-1639 as of 2026-05-30.
How do I remediate CVE-2018-1639?
Priority: MONITOR. Advisory: https://www.ibm.com/support/docview.wss?uid=ibm10731727 PSIRT: [email protected]
What systems are affected by CVE-2018-1639?
CVE-2018-1639 affects Ibm Jazz Reporting Service.
Vulnerability Details
CVE IDCVE-2018-1639
BSIDBS-2018-GLOBAL-216772-M BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published2018-11-16
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
Exposure of Sensitive Information
SourceNVD
Official Description

The Report Builder of Jazz Reporting Service 5.0 through 5.0.2 and 6.0 through 6.0.6 could allow an authenticated user to obtain sensitive information beyond its assigned privileges. IBM X-Force ID: 144579.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: The Report Builder of Jazz Reporting Service 5.0 through 5.0.2 and 6.0 through 6.0.6 could allow an authenticated user to obtain sensitive information beyond its assigned privileges. IBM X-Force ID: 144579. CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Exploitation Likelihood: MINIMAL

Affected Products
VendorProductAffected Versions
Ibm Jazz Reporting Service ≥ 5.0, ≤ 5.0.2 ≥ 6.0.3, ≤ 6.0.6 ≥ 6.0, ≤ 6.0.2
Remediation
View Vendor Advisory →

Remediation Priority: MONITOR

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2890 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash02844261a3596aac97510d4701af3967e374c005866f3002480da84bfcbaf8615dea145b986a0a5c8ba39dd3ad97a595556cbe011eee3cbc3a14033e779b84fe
Related CVEs affecting Ibm
CVE-2009-3699 10.0 Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in ... CVE-2010-3187 10.0 Buffer overflow in ftpd in IBM AIX 5.3 and earlier allows remote attackers to... CVE-2009-3517 10.0 nfs.ext in IBM AIX 5.3.x through 5.3.9 and 6.1.0 through 6.1.2 does not prope... CVE-2009-3935 10.0 Multiple unspecified vulnerabilities in the Advanced Management Module firmwa... CVE-2010-3754 10.0 The FXCLI_OraBR_Exec_Command function in FastBackServer.exe in the Server in ...
View all Ibm CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →