CVE-2015-0146
IBM Content Collector for Email 3.0-4.0 - Information Disclosure via Crafted Search Query
Title source: llmDescription
IBM Content Collector for Email 3.0 before 3.0.0.6-IBM-ICC-Server-IF001 and 4.0 before 4.0.0.3-IBM-ICC-Server-IF001 does not properly handle an unspecified query operator during searches of IBM FileNet P8 systems with IBM Content Search Services, which allows local users to bypass intended document-access restrictions and obtain sensitive information via a crafted search query.
References (1)
Core 1
Core References
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21696594
Scores
EPSS
0.0032
EPSS Percentile
24.4%
Details
CWE
CWE-264
Status
published
Products (9)
ibm/content_collector
3.0.0.0
ibm/content_collector
3.0.0.1
ibm/content_collector
3.0.0.2
ibm/content_collector
3.0.0.3
ibm/content_collector
3.0.0.4
ibm/content_collector
3.0.0.5
ibm/content_collector
4.0.0.0
ibm/content_collector
4.0.0.1
ibm/content_collector
4.0.0.2
Published
Mar 18, 2015
Tracked Since
Feb 18, 2026