CVE-2015-1961 Code injection in n/a
Authenticated users can bypass access restrictions to execute arbitrary JavaScript code on the server via the REST API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-1961?
CVE-2015-1961 is a critical code injection vulnerability in Ibm Business Process Manager, published on 13 Jul 2015. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions and execute arbitrary JavaScript code on the server via an unspecified API call.
Weakness: CWE-284
Which versions are affected by CVE-2015-1961?
It affects 1 product.
Products include Ibm Business Process Manager.
How do I fix CVE-2015-1961?
No fix has been published for CVE-2015-1961 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2015-1961 being exploited?
There is no known exploitation of CVE-2015-1961 in the wild and no public exploit code.
Other vulnerabilities in Ibm Business Process Manager
- CVE-2017-1769 Cross-site request forgery in Business Process Manager
- CVE-2017-1539 Privilege escalation in Business Process Manager Advanced
- CVE-2017-1527 XML external entity in Business Process Manager Advanced
- CVE-2015-7441 Weak cryptography in n/a
- CVE-2017-1628 Missing authorization in Business Process Manager
Sources
Also known as GHSA-8v4h-q88f-qv58.