CVE-2015-0175: Medium severity ibm websphere application server feature pack for web services vulnerability

Published Apr 26, 2015

Updated

IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors.

Affected Software

8 affected components

IBM WebSphere Application Server Feature Pack for Web Services=8.5.0.0

IBM WebSphere Application Server Feature Pack for Web Services=8.5.0.1

IBM WebSphere Application Server Feature Pack for Web Services=8.5.0.2

IBM WebSphere Application Server Feature Pack for Web Services=8.5.5.0

IBM WebSphere Application Server Feature Pack for Web Services=8.5.5.1

IBM WebSphere Application Server Feature Pack for Web Services=8.5.5.2

IBM WebSphere Application Server Feature Pack for Web Services=8.5.5.3

IBM WebSphere Application Server Feature Pack for Web Services=8.5.5.4

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21697368

Event History

Apr 26, 2015

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-0175?

CVE-2015-0175 is rated as a moderate severity vulnerability due to potential privilege escalation by authenticated users.

How do I fix CVE-2015-0175?

To fix CVE-2015-0175, you should upgrade IBM WebSphere Application Server to version 8.5.5.5 or later.

Who is affected by CVE-2015-0175?

CVE-2015-0175 affects users of IBM WebSphere Application Server versions 8.5.0.0 through 8.5.5.4.

What impact does CVE-2015-0175 have on the system?

CVE-2015-0175 allows unauthorized privilege escalation, potentially enabling users to perform actions beyond their intended access rights.

When was CVE-2015-0175 disclosed?

CVE-2015-0175 was disclosed in January 2015, alongside the release of the related patch.