CVE-2009-3518
Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager...
Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and Rational Team Concert, allows remote attackers to load arbitrary DLL files via the -vm option, as demonstrated by a reference to a UNC share pathname.
Exploit likelihood
What each source reports
NVD Score used
Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and Rational Team Concert, allows remote attackers to load arbitrary DLL files via the -vm option, as demonstrated by a reference to a UNC share pathname.
- Record
CVE-2009-3518- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and Rational Team Concert, allows remote attackers to load arbitrary DLL files via the -vm option, as demonstrated by a reference to a UNC share pathname.
- Record
CVE-2009-3518- Updated
- 2026-11-02
EUVDEUVD-2009-3500 No score
Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and Rational Team Concert, allows remote attackers to load arbitrary DLL files via the -vm option, as demonstrated by a reference to a UNC share pathname.
- Record
EUVD-2009-3500- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-47gr-pfr8-r958 No score
Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager...
Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and Rational Team Concert, allows remote attackers to load arbitrary DLL files via the -vm option, as demonstrated by a reference to a UNC share pathname.
- Record
GHSA-47gr-pfr8-r958- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | IBM Installation Manager 1.3.0 - 'iim://' URI handler | 2009-09-29 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3518 is a high vulnerability (CVSS 9.3) in Ibm Installation Manager, published October 1, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.48%, the 92nd percentile. No source names a fixed version.