{"api_version":"1","generated_at":"2026-07-23T09:31:37+00:00","cve":"CVE-2015-5003","urls":{"html":"https://cve.report/CVE-2015-5003","api":"https://cve.report/api/cve/CVE-2015-5003.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-5003","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-5003"},"summary":{"title":"CVE-2015-5003","description":"The portal in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 before FP7 allows remote authenticated users to execute arbitrary commands by leveraging Take Action view authority and providing crafted input.","state":"PUBLISHED","assigner":"ibm","published_at":"2016-01-03 05:59:02","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-77","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"8.5","severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"8.5","severity":"","vector":"AV:N/AC:M/Au:S/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:C/I:C/A:C","baseScore":8.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://www.securitytracker.com/id/1034924","name":"http://www.securitytracker.com/id/1034924","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM Tivoli Monitoring Flaw Lets Remote Authenticated Users Execute Arbitrary Commands on the Target System - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV77742","name":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV77742","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IV77742: ALLOW CHARACTER EXCLUDE LIST FOR TAKE ACTION","mime":"text/html","httpstatus":"200","archivestatus":"410"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21970361","name":"http://www-01.ibm.com/support/docview.wss?uid=swg21970361","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"IBM Security Bulletin:  IBM Tivoli Monitoring Remote Code Execution (CVE-2015-5003) - United States","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5003","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5003","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"5003","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"tivoli_monitoring","cpe6":"6.2.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5003","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"tivoli_monitoring","cpe6":"6.2.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5003","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"tivoli_monitoring","cpe6":"6.3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T06:32:31.547Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"IV77742","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV77742"},{"name":"1034924","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1034924"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21970361"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-11-21T00:00:00.000Z","descriptions":[{"lang":"en","value":"The portal in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 before FP7 allows remote authenticated users to execute arbitrary commands by leveraging Take Action view authority and providing crafted input."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-12-02T20:57:01.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"name":"IV77742","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV77742"},{"name":"1034924","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1034924"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21970361"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","ID":"CVE-2015-5003","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The portal in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 before FP7 allows remote authenticated users to execute arbitrary commands by leveraging Take Action view authority and providing crafted input."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"IV77742","refsource":"AIXAPAR","url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV77742"},{"name":"1034924","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1034924"},{"name":"http://www-01.ibm.com/support/docview.wss?uid=swg21970361","refsource":"CONFIRM","url":"http://www-01.ibm.com/support/docview.wss?uid=swg21970361"}]}}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2015-5003","datePublished":"2016-01-03T02:00:00.000Z","dateReserved":"2015-06-24T00:00:00.000Z","dateUpdated":"2024-08-06T06:32:31.547Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2016-01-03 05:59:02","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-77","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:C/I:C/A:C","baseScore":8.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":6.8,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:tivoli_monitoring:6.2.2:*:*:*:*:*:*:*","matchCriteriaId":"15E20435-C3A0-4A57-B82A-595A48BB0991"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:tivoli_monitoring:6.2.3:*:*:*:*:*:*:*","matchCriteriaId":"88380637-715A-49CB-A9B6-0F8411225E9C"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:tivoli_monitoring:6.3.0:*:*:*:*:*:*:*","matchCriteriaId":"EBDE2E0B-6F98-4289-A3AF-EF4105782C7B"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"5003","Ordinal":"1","Title":"CVE-2015-5003","CVE":"CVE-2015-5003","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"5003","Ordinal":"1","NoteData":"The portal in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 before FP7 allows remote authenticated users to execute arbitrary commands by leveraging Take Action view authority and providing crafted input.","Type":"Description","Title":"CVE-2015-5003"},{"CveYear":"2015","CveId":"5003","Ordinal":"2","NoteData":"2016-01-02","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"5003","Ordinal":"3","NoteData":"2016-12-02","Type":"Other","Title":"Modified"}]}}}