CVE-2018-1808

HIGH

IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control. IBM X-Force ID: 149828.

Affects 1 product across 1 vendor.

CVSS 3.08.8
EPSS1.6%
Percentile75th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-94: Code Injection

Attacker injects arbitrary code that is executed by the application process.

Related Attack Patterns (CAPEC)
CAPEC-35 Leverage Executable Code in Non-Executable Files
via CWE-94
CAPEC-77 Manipulating User-Controlled Variables
via CWE-94
CAPEC-242 Code Injection
via CWE-94

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2018. A high severity vulnerability affects Ibm systems (CVE-2018-1808). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2018-GLOBAL-216994-H • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2018-1808?
This vulnerability was disclosed in 2018. A high severity vulnerability affects Ibm systems (CVE-2018-1808). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2018-1808?
CVE-2018-1808 has CVSS 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.6%.
Is CVE-2018-1808 actively exploited?
No confirmed active exploitation of CVE-2018-1808 as of 2026-05-30.
How do I remediate CVE-2018-1808?
Priority: MEDIUM. PSIRT: [email protected]
What systems are affected by CVE-2018-1808?
CVE-2018-1808 affects Ibm Websphere Commerce.
Vulnerability Details
CVE IDCVE-2018-1808
BSIDBS-2018-GLOBAL-216994-H BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published2018-11-13
Last Modified2024-11-21
ICS Relevance15%
Weakness (CWE)
Code Injection
SourceNVD
Official Description

IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control. IBM X-Force ID: 149828.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control. IBM X-Force ID: 149828. CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Exploitation Likelihood: MINIMAL

Affected Products
VendorProductAffected Versions
Ibm Websphere Commerce ≥ 9.0.0.0, ≤ 9.0.0.6
Remediation

No official vendor advisory link on record. See the CVE record →

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2898 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash9cd9c93fc779232bf486b0b0f78d024264179f80d941b48e8a85f0a1126a603125d862a06a85b700f9100193b2b5dbf9d688bd8834059d9a0c11c8ac810bf5ce
Related CVEs affecting Ibm
CVE-1999-1119 10.0 FTP installation script anon.ftp in AIX insecurely configures anonymous FTP, ... CVE-1999-0099 10.0 Buffer overflow in syslog utility allows local or remote attackers to gain ro... CVE-1999-0088 10.0 IRIX and AIX automountd services (autofsd) allow remote users to execute root... CVE-1999-0101 10.0 Buffer overflow in AIX and Solaris "gethostbyname" library call allows root a... CVE-1999-0097 10.0 The AIX FTP client can be forced to execute commands from a malicious server ...
View all Ibm CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →