Lucene search

K
ibmIBM7B3AC56328D3147E79BEC5737ADB41C519A985674FD8C6C608CC27164A464E84
HistorySep 14, 2022 - 3:02 p.m.

Security Bulletin: CVE-2015-7450 affects the desktop IBM Process Designer used in IBM Business Automation Workflow and IBM Business Process Manager

2022-09-1415:02:20
www.ibm.com
12

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.971 High

EPSS

Percentile

99.8%

Summary

The following vulnerability in Apache commons that affects the desktop IBM Process Designer has been addressed.

Vulnerability Details

CVEID:CVE-2015-7450
**DESCRIPTION:**Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
CVSS Base score: 9.8
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Products Versions
IBM Business Automation Workflow 18.0.0.0 - 19.0.0.3
IBM Business Process Manager 8.6.0.0 - 8.6.0.0 CF2018.03
IBM Business Process Manager 8.5.0.0 - 8.5.7 2017.06
IBM Business Process Manager 8.0.0.0 - 8.0.1.3

Remediation/Fixes

Install interim fix JR61681 for your version:

Workarounds and Mitigations

None

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.971 High

EPSS

Percentile

99.8%

Related for 7B3AC56328D3147E79BEC5737ADB41C519A985674FD8C6C608CC27164A464E84