PT-2015-2599 · Ibm · Ibm Websphere Portal

Published 2015-10-29 · Updated 2016-12-07 · CVE-2015-4997

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal version 8.5.0 before CF08

Description The issue is related to insufficient access control in the user interface of the IBM WebSphere Portal server application, allowing remote attackers to bypass intended access restrictions via a crafted request. This can enable a remote attacker to circumvent existing access restrictions using a specially formed request.

Recommendations For IBM WebSphere Portal version 8.5.0 before CF08, apply Cumulative Fix 08 or a later fix to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-11964

CVE-2015-4997

Affected Products

Ibm Websphere Portal

References · 6

• https://bdu.fstec.ru/vul/2015-11964 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-4997 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21968474 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1PI47694 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4997 · Note
• http://securitytracker.com/id/1033982 · Note