CVE-2015-7818 Code injection in n/a

High 7.2 Published 12 Nov 2015 Updated 6 Aug 2024

Local attackers can execute arbitrary JSP code with SYSTEM privileges in IBM/Lenovo Switch Center via the Apache Axis AdminService.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2015-7818?

CVE-2015-7818 is a high-severity code injection vulnerability in n/a, published on 12 Nov 2015. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows local users to execute arbitrary JSP code with SYSTEM privileges by using the Apache Axis AdminService deployment method to install a .jsp file.

Weakness: CWE-264

Which versions are affected by CVE-2015-7818?

It affects 2 products.

Products include Ibm System Networking Switch Center, Lenovo Switch Center.

How do I fix CVE-2015-7818?

No fix has been published for CVE-2015-7818 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2015-7818 being exploited?

There is no known exploitation of CVE-2015-7818 in the wild and no public exploit code.

Sources

Also known as GHSA-q752-6c9f-vmmc.