NetSight
IP …
critical9.8Known exploitedPublic exploit code

CVE-2015-7450

IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-01-10. Federal due date: 2022-07-10.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.

Affected products

VendorProductAffected versions
IbmSterling B2b Integrator
Version 5.2
IbmSterling Integrator
Version 5.1
IbmTivoli Common Reporting
Versions 2.1, 2.1.1, 2.1.1.2, 3.1, 3.1.0.1, 3.1.0.2
IbmWatson Content Analytics
from 3.0 through 3.0.0.6
from 3.5 through 3.5.0.3
IbmWatson Explorer Analytical Components
from 10.0 through 10.0.0.2
Version 11.0
IbmWatson Explorer Annotation Administration Console
from 10.0 through 10.0.0.2
Version 11.0
IbmWebsphere Application Server
Versions 7.0.0.0, 8.0.0.0, 8.5, 8.5.0.0, 8.5.5.5

Weakness classification

CWE-502

References