CVE-2015-1882: Race Condition

Published Apr 26, 2015

Updated

Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user.

Affected Software

8 affected components

IBM WebSphere Application Server Feature Pack for Web Services=8.5.0.0

IBM WebSphere Application Server Feature Pack for Web Services=8.5.0.1

IBM WebSphere Application Server Feature Pack for Web Services=8.5.0.2

IBM WebSphere Application Server Feature Pack for Web Services=8.5.5.0

IBM WebSphere Application Server Feature Pack for Web Services=8.5.5.1

IBM WebSphere Application Server Feature Pack for Web Services=8.5.5.2

IBM WebSphere Application Server Feature Pack for Web Services=8.5.5.3

IBM WebSphere Application Server Feature Pack for Web Services=8.5.5.4

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21697368

Event History

Apr 26, 2015

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-1882?

CVE-2015-1882 is classified as a high severity vulnerability due to its potential for privilege escalation.

What software versions are affected by CVE-2015-1882?

CVE-2015-1882 affects IBM WebSphere Application Server versions 8.5.0.0 to 8.5.5.4, including several specific versions in between.

How can I fix CVE-2015-1882?

To fix CVE-2015-1882, you should upgrade your IBM WebSphere Application Server to version 8.5.5.5 or later.

What type of vulnerability is CVE-2015-1882?

CVE-2015-1882 is a race condition vulnerability that allows remote authenticated users to execute Java code outside the context of the configured EJB Run-as user.

Can CVE-2015-1882 be exploited remotely?

Yes, CVE-2015-1882 can be exploited remotely by authenticated users due to the presence of thread conflicts.