CVE-2014-4767: Code Injection

Published Aug 22, 2014

Updated

IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.3 does not properly use the Liberty Repository for feature installation, which allows remote authenticated users to execute arbitrary code via unspecified vectors.

Affected Software

6 affected components

IBM WebSphere Application Server Feature Pack for Web Services=8.5.0.0

IBM WebSphere Application Server Feature Pack for Web Services=8.5.0.1

IBM WebSphere Application Server Feature Pack for Web Services=8.5.0.2

IBM WebSphere Application Server Feature Pack for Web Services=8.5.5.0

IBM WebSphere Application Server Feature Pack for Web Services=8.5.5.1

IBM WebSphere Application Server Feature Pack for Web Services=8.5.5.2

Event History

Aug 22, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-4767?

CVE-2014-4767 is classified as a high severity vulnerability due to the potential for remote code execution.

How do I fix CVE-2014-4767?

To remediate CVE-2014-4767, upgrade IBM WebSphere Application Server Liberty Profile to version 8.5.5.3 or later.

What software is affected by CVE-2014-4767?

CVE-2014-4767 affects IBM WebSphere Application Server Liberty Profile versions 8.5.0.0 through 8.5.5.2.

Who can exploit CVE-2014-4767?

CVE-2014-4767 can be exploited by remote authenticated users who have knowledge of the affected system.

What can attackers do with CVE-2014-4767?

Attackers exploiting CVE-2014-4767 can execute arbitrary code on the server, potentially compromising the entire system.