PT-2017-4045 · Rogue Wave · Rogue Wave Jviews

Published 2017-04-06 · Updated 2022-07-23 · CVE-2015-8965

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rogue Wave JViews versions 8.8 through 8.8 patch 20 Rogue Wave JViews versions 8.9 through 8.9 patch 0

Description The issue allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administration code. This is due to the ilog.views.faces.IlvFacesController servlet in jviews-framework-all.jar not requiring explicit configuration of servlets that can be called. The vulnerability is related to insufficient access control checks, which can be exploited by a remote attacker to execute arbitrary code.

Recommendations For Rogue Wave JViews versions 8.8 through 8.8 patch 20, apply patch 21 to resolve the issue. For Rogue Wave JViews versions 8.9 through 8.9 patch 0, apply patch 1 to resolve the issue. As a temporary workaround, consider restricting access to the ilog.views.faces.IlvFacesController servlet in jviews-framework-all.jar to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2021-00591

CVE-2015-8965

Affected Products

Rogue Wave Jviews

References · 8

• https://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Patch
• https://bdu.fstec.ru/vul/2021-00591 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-8965 · Security Note
• https://rwkbp.makekb.com/?View=entry&EntryID=2521 · Vendor Advisory
• https://t.me/cvenotify/9163 · Telegram Post
• https://rwkbp.makekb.com/?View=entry&EntryID=2521 · Note
• https://oracle.com/security-alerts/cpujan2021.html · Note
• https://t.me/cvenotify/33681 · Telegram Post