CVE-2015-4963
Summary
| CVE | CVE-2015-4963 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2015-11-08 22:59:12 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | IBM Security Access Manager for Web 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandles WebSEAL HTTPTransformation requests, which allows remote attackers to read or write to arbitrary files via unspecified vectors. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ibm | Security Access Manager For Web | 7.0 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 7.0.0.1 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 7.0.0.10 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 7.0.0.11 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 7.0.0.12 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 7.0.0.13 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 7.0.0.14 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 7.0.0.15 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 7.0.0.2 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 7.0.0.3 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 7.0.0.4 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 7.0.0.5 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 7.0.0.6 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 7.0.0.7 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 7.0.0.8 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 7.0.0.9 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 8.0 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 8.0.0.2 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 8.0.0.22 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 8.0.0.3 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 8.0.0.31 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 8.0.0.4 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 8.0.0.5 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 8.0.1.0 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 8.0.1.1 | All | All | All |
| Application | Ibm | Security Access Manager For Web | 8.0.1.2 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| IBM notice: The page you requested cannot be displayed | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | |
| IBM Security Access Manager for Web HTTPTransformation Processing Flaw Lets Remote Users Read and Write Files on the Target System - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| IBM Security Bulletin: IBM Security Access Manager for Web is affected by a vulnerability in the WebSEAL HTTPTransformation request processing (CVE-2015-4963) - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.