CVE-2015-7494: Low severity IBM Cloud Orchestrator vulnerability

Published Feb 8, 2017

Updated

A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.

Affected Software

8 affected components

IBM Cloud Orchestrator=2.4

IBM Cloud Orchestrator=2.4.0.1

IBM Cloud Orchestrator=2.4.0.2

IBM Cloud Orchestrator=2.4.0.3

IBM Cloud Orchestrator=2.5

IBM Cloud Orchestrator=2.5.01

IBM Smartcloud Orchestrator=2.3

IBM Smartcloud Orchestrator=2.3.0.1

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg2C1000140

Event History

Feb 8, 2017

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

DescriptionWeakness

Data Sourced

via NVD·10:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2015-7494?

CVE-2015-7494 is classified as a medium severity vulnerability.

How do I fix CVE-2015-7494?

To remediate CVE-2015-7494, apply the latest patches and updates provided by IBM for the affected versions.

Who is affected by CVE-2015-7494?

CVE-2015-7494 affects IBM Cloud Orchestrator versions 2.4, 2.5 and certain versions of IBM SmartCloud Orchestrator.

What actions can be exploited in CVE-2015-7494?

CVE-2015-7494 can be exploited through a /services/[action]/launch API call by an authenticated domain admin user.

What kind of resources can be affected by CVE-2015-7494?

CVE-2015-7494 allows an authenticated domain admin user to modify cross-domain resources.