Skip to main content

Privileged Access Manager CVE-2018-9021

CRITICAL
Improper Privilege Management (CWE-269)
2018-06-18 vuln@ca.com
Authentication Bypass Privilege Escalation Privileged Access Manager
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jun 18, 2018 - 18:29 nvd
CRITICAL 9.8

DescriptionNVD

An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary commands with specially crafted requests.

AnalysisAI

An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary commands with specially crafted requests. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary commands with specially crafted requests. Affected products include: Broadcom Privileged Access Manager.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.

More in Privileged Access Manager

View all
CVE-2018-9022 CRITICAL POC
9.8 Jun 18

An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to exec
CVE-2018-9029 CRITICAL
9.8 Jun 18

An improper input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to conduct SQL in
CVE-2019-7392 CRITICAL
9.1 Feb 26

An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a re
CVE-2018-9023 HIGH
8.8 Jun 18

An input validation vulnerability in CA Privileged Access Manager 2.x allows unprivileged users to execute arbitrary com
CVE-2018-9028 HIGH
7.5 Jun 18

Weak cryptography used for passwords in CA Privileged Access Manager 2.x reduces the complexity for password cracking. R
CVE-2018-9026 HIGH
7.5 Jun 18

A session fixation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to hijack user sessions wit
CVE-2018-9025 HIGH
7.5 Jun 18

An input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to poison log files with s
CVE-2018-9024 MEDIUM
5.3 Jun 18

An improper authentication vulnerability in CA Privileged Access Manager 2.x allows attackers to spoof IP addresses in a
CVE-2024-54840 MEDIUM
4.2 Feb 03

PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address

Same weakness CWE-269 – Improper Privilege Management

View all
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2012-3993 CRITICAL POC
9.3
CVE-2017-11467 CRITICAL POC
9.8
CVE-2014-1510 CRITICAL POC
9.8
CVE-2014-1511 CRITICAL POC
9.8
CVE-2016-0151 HIGH POC
7.8
CVE-2013-0643 HIGH
8.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2018-9021 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy