CVE-2015-0110
Summary
| CVE | CVE-2015-0110 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-09-15 20:29:00 UTC |
| Updated | 2017-09-26 18:29:00 UTC |
| Description | IBM Business Process Manager (aka BPM) 7.5.x, 8.0.x, and 8.5.x and WebSphere Lombardi Edition (aka WLE) 7.2.x allow remote authenticated users to bypass intended access restrictions on internal service types via vectors involving the executeServiceByName URL. |
Risk And Classification
Problem Types: CWE-284
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ibm | Business Process Manager | 7.5.0.0 | All | All | All |
| Application | Ibm | Business Process Manager | 7.5.0.1 | All | All | All |
| Application | Ibm | Business Process Manager | 7.5.1.0 | All | All | All |
| Application | Ibm | Business Process Manager | 7.5.1.1 | All | All | All |
| Application | Ibm | Business Process Manager | 7.5.1.2 | All | All | All |
| Application | Ibm | Business Process Manager | 8.0.0.0 | All | All | All |
| Application | Ibm | Business Process Manager | 8.0.1.0 | All | All | All |
| Application | Ibm | Business Process Manager | 8.0.1.1 | All | All | All |
| Application | Ibm | Business Process Manager | 8.0.1.2 | All | All | All |
| Application | Ibm | Business Process Manager | 8.0.1.3 | All | All | All |
| Application | Ibm | Business Process Manager | 8.5.0.0 | All | All | All |
| Application | Ibm | Business Process Manager | 8.5.0.1 | All | All | All |
| Application | Ibm | Business Process Manager | 8.5.5.0 | All | All | All |
| Application | Ibm | Business Process Manager | 7.5.0.0 | All | All | All |
| Application | Ibm | Business Process Manager | 7.5.0.1 | All | All | All |
| Application | Ibm | Business Process Manager | 7.5.1.0 | All | All | All |
| Application | Ibm | Business Process Manager | 7.5.1.1 | All | All | All |
| Application | Ibm | Business Process Manager | 7.5.1.2 | All | All | All |
| Application | Ibm | Business Process Manager | 8.0.0.0 | All | All | All |
| Application | Ibm | Business Process Manager | 8.0.1.0 | All | All | All |
| Application | Ibm | Business Process Manager | 8.0.1.1 | All | All | All |
| Application | Ibm | Business Process Manager | 8.0.1.2 | All | All | All |
| Application | Ibm | Business Process Manager | 8.0.1.3 | All | All | All |
| Application | Ibm | Business Process Manager | 8.5.0.0 | All | All | All |
| Application | Ibm | Business Process Manager | 8.5.0.1 | All | All | All |
| Application | Ibm | Business Process Manager | 8.5.5.0 | All | All | All |
| Application | Ibm | Websphere Application Server | 7.2.0.0 | All | All | All |
| Application | Ibm | Websphere Application Server | 7.2.0.1 | All | All | All |
| Application | Ibm | Websphere Application Server | 7.2.0.2 | All | All | All |
| Application | Ibm | Websphere Application Server | 7.2.0.3 | All | All | All |
| Application | Ibm | Websphere Application Server | 7.2.0.4 | All | All | All |
| Application | Ibm | Websphere Application Server | 7.2.0.5 | All | All | All |
| Application | Ibm | Websphere Application Server | 7.2.0.0 | All | All | All |
| Application | Ibm | Websphere Application Server | 7.2.0.1 | All | All | All |
| Application | Ibm | Websphere Application Server | 7.2.0.2 | All | All | All |
| Application | Ibm | Websphere Application Server | 7.2.0.3 | All | All | All |
| Application | Ibm | Websphere Application Server | 7.2.0.4 | All | All | All |
| Application | Ibm | Websphere Application Server | 7.2.0.5 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Multiple IBM Products CVE-2015-0110 Security Bypass Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Security Bulletin: Internal service types can be invoked in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) Process Portal (CVE-2015-0110) | CONFIRM | www-304.ibm.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.