CVE-2015-1884

Опубликовано: 28 июн. 2015

Источник: nvd

CVSS2: 4

EPSS Низкий

Описание

Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted internationalization-file URL.

Ссылки

http://www-01.ibm.com/support/docview.wss?uid=swg1JR52957
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21700831
Patch
Vendor Advisory
http://www.securityfocus.com/bid/75360
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1032700
http://www.securitytracker.com/id/1032701
http://www-01.ibm.com/support/docview.wss?uid=swg1JR52957
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21700831
Patch
Vendor Advisory
http://www.securityfocus.com/bid/75360
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1032700
http://www.securitytracker.com/id/1032701

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.0.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.0.1:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.1:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:7.5.1.2:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.0.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.1:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.2:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.0.1.3:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.0.1:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:advanced:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:express:*:*:*

cpe:2.3:a:ibm:business_process_manager:8.5.5.0:*:*:*:standard:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:ibm:websphere:7.2:*:*:*:lombardi:*:*:*

cpe:2.3:a:ibm:websphere:7.2.0.1:*:*:*:lombardi:*:*:*

cpe:2.3:a:ibm:websphere:7.2.0.2:*:*:*:lombardi:*:*:*

cpe:2.3:a:ibm:websphere:7.2.0.3:*:*:*:lombardi:*:*:*

cpe:2.3:a:ibm:websphere:7.2.0.4:*:*:*:lombardi:*:*:*

cpe:2.3:a:ibm:websphere:7.2.0.5:*:*:*:lombardi:*:*:*

EPSS

Процентиль: 74%

0.00808

Низкий

4 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-33cg-4pq4-gv4q

github

больше 3 лет назад

BDU:2015-10513

fstec

больше 10 лет назад

Уязвимость сервера приложений WebSphere Application Server, позволяющая нарушителю читать произвольные файлы

BDU:2015-10512