CVE-2015-1884 Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (W...
MediumCVSS 4.0
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted internationalization-file URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm business process manager | = 7.5.0.0 | No fix listed |
| ibm business process manager | = 7.5.0.1 | No fix listed |
| ibm business process manager | = 7.5.1.0 | No fix listed |
| ibm business process manager | = 7.5.1.1 | No fix listed |
| ibm business process manager | = 7.5.1.2 | No fix listed |
| ibm business process manager | = 8.0.0.0 | No fix listed |
| ibm business process manager | = 8.0.1.0 | No fix listed |
| ibm business process manager | = 8.0.1.1 | No fix listed |
| ibm business process manager | = 8.0.1.2 | No fix listed |
| ibm business process manager | = 8.0.1.3 | No fix listed |
| ibm business process manager | = 8.5.0.0 | No fix listed |
| ibm business process manager | = 8.5.0.1 | No fix listed |
| ibm business process manager | = 8.5.5.0 | No fix listed |
| ibm websphere | = 7.2 | No fix listed |
| ibm websphere | = 7.2.0.1 | No fix listed |
| ibm websphere | = 7.2.0.2 | No fix listed |
| ibm websphere | = 7.2.0.3 | No fix listed |
| ibm websphere | = 7.2.0.4 | No fix listed |
| ibm websphere | = 7.2.0.5 | No fix listed |
References
- JR52957 patch vendor-advisory
- www-01.ibm.com patch vendor-advisory
- 75360 third-party-advisory vdb-entry
- 1032700 vdb-entry
- 1032701 vdb-entry