CVE-2015-1882: Race Condition
First published: Mon Apr 27 2015(Updated: )
Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ibm Websphere Application Server | =8.5.0.0 | |
| Ibm Websphere Application Server | =8.5.0.1 | |
| Ibm Websphere Application Server | =8.5.0.2 | |
| Ibm Websphere Application Server | =8.5.5.0 | |
| Ibm Websphere Application Server | =8.5.5.1 | |
| Ibm Websphere Application Server | =8.5.5.2 | |
| Ibm Websphere Application Server | =8.5.5.3 | |
| Ibm Websphere Application Server | =8.5.5.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2015-1882?
CVE-2015-1882 is classified as a high severity vulnerability due to its potential for privilege escalation.
What software versions are affected by CVE-2015-1882?
CVE-2015-1882 affects IBM WebSphere Application Server versions 8.5.0.0 to 8.5.5.4, including several specific versions in between.
How can I fix CVE-2015-1882?
To fix CVE-2015-1882, you should upgrade your IBM WebSphere Application Server to version 8.5.5.5 or later.
What type of vulnerability is CVE-2015-1882?
CVE-2015-1882 is a race condition vulnerability that allows remote authenticated users to execute Java code outside the context of the configured EJB Run-as user.
Can CVE-2015-1882 be exploited remotely?
Yes, CVE-2015-1882 can be exploited remotely by authenticated users due to the presence of thread conflicts.
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/remedy
- vendor/ibm
- canonical/ibm websphere application server
- version/ibm websphere application server/8.5.0.0
- version/ibm websphere application server/8.5.0.1
- version/ibm websphere application server/8.5.0.2
- version/ibm websphere application server/8.5.5.0
- version/ibm websphere application server/8.5.5.1
- version/ibm websphere application server/8.5.5.2
- version/ibm websphere application server/8.5.5.3
- version/ibm websphere application server/8.5.5.4