CVE-2015-7441

MEDIUM

IBM WebSphere Process Server <8.5.6 - Info Disclosure

Title source: llm
STIX 2.1

Description

Remote Artifact Loader (RAL) in IBM WebSphere Process Server 7 and Business Process Manager Advanced 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.2, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.2 does not properly use SSL for its HTTPS connection, which allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034531
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1JR54760
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034532

Scores

CVSS v3 6.8
EPSS 0.0139
EPSS Percentile 69.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-17
Status published
Products (13)
ibm/business_process_manager 7.5.0.0 (3 CPE variants)
ibm/business_process_manager 7.5.0.1 (4 CPE variants)
ibm/business_process_manager 7.5.1.0 (4 CPE variants)
ibm/business_process_manager 7.5.1.1 (4 CPE variants)
ibm/business_process_manager 7.5.1.2 (4 CPE variants)
ibm/business_process_manager 8.0.0.0 (4 CPE variants)
ibm/business_process_manager 8.0.1.0 (4 CPE variants)
ibm/business_process_manager 8.0.1.1 (4 CPE variants)
ibm/business_process_manager 8.0.1.2 (4 CPE variants)
ibm/business_process_manager 8.0.1.3 (3 CPE variants)
... and 3 more
Published Jan 01, 2016
Tracked Since Feb 18, 2026