Vulnerability-Lookup

CVE-2015-7494 (GCVE-0-2015-7494)

Vulnerability from cvelistv5 – Published: 2017-02-08 22:00 – Updated: 2024-08-06 07:51

Summary

A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.

Severity ?

No CVSS data available.

CWE

Gain Access

Assigner

ibm

References

2 references

URL	Tags
http://www.ibm.com/support/docview.wss?uid=swg2C1000140	x_refsource_CONFIRM
http://www.securityfocus.com/bid/94438	vdb-entryx_refsource_BID

Impacted products

1 product

Vendor	Product	Version
IBM Corporation	Cloud Orchestrator	Affected: 2.2 Affected: 2.2.0.1 Affected: 2.3 Affected: 2.4 Affected: 2.3.0.1 Affected: 2.4.0.1 Affected: 2.4.0.2 Affected: 2.5 Affected: 2.5.0.1 Affected: 2.4.0.3 Affected: 2.5.0.2

Date Public ?

2016-11-18 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T07:51:28.123Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.ibm.com/support/docview.wss?uid=swg2C1000140"
          },
          {
            "name": "94438",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94438"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cloud Orchestrator",
          "vendor": "IBM Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "2.2"
            },
            {
              "status": "affected",
              "version": "2.2.0.1"
            },
            {
              "status": "affected",
              "version": "2.3"
            },
            {
              "status": "affected",
              "version": "2.4"
            },
            {
              "status": "affected",
              "version": "2.3.0.1"
            },
            {
              "status": "affected",
              "version": "2.4.0.1"
            },
            {
              "status": "affected",
              "version": "2.4.0.2"
            },
            {
              "status": "affected",
              "version": "2.5"
            },
            {
              "status": "affected",
              "version": "2.5.0.1"
            },
            {
              "status": "affected",
              "version": "2.4.0.3"
            },
            {
              "status": "affected",
              "version": "2.5.0.2"
            }
          ]
        }
      ],
      "datePublic": "2016-11-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Gain Access",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-02-09T10:57:02.000Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.ibm.com/support/docview.wss?uid=swg2C1000140"
        },
        {
          "name": "94438",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94438"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2015-7494",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cloud Orchestrator",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2.2"
                          },
                          {
                            "version_value": "2.2.0.1"
                          },
                          {
                            "version_value": "2.3"
                          },
                          {
                            "version_value": "2.4"
                          },
                          {
                            "version_value": "2.3.0.1"
                          },
                          {
                            "version_value": "2.4.0.1"
                          },
                          {
                            "version_value": "2.4.0.2"
                          },
                          {
                            "version_value": "2.5"
                          },
                          {
                            "version_value": "2.5.0.1"
                          },
                          {
                            "version_value": "2.4.0.3"
                          },
                          {
                            "version_value": "2.5.0.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Gain Access"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.ibm.com/support/docview.wss?uid=swg2C1000140",
              "refsource": "CONFIRM",
              "url": "http://www.ibm.com/support/docview.wss?uid=swg2C1000140"
            },
            {
              "name": "94438",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94438"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2015-7494",
    "datePublished": "2017-02-08T22:00:00.000Z",
    "dateReserved": "2015-09-29T00:00:00.000Z",
    "dateUpdated": "2024-08-06T07:51:28.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2015-7494",
      "date": "2026-05-19",
      "epss": "0.00046",
      "percentile": "0.14302"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:cloud_orchestrator:2.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FE37CE11-6A58-4058-B3A0-5A223DC5601B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:cloud_orchestrator:2.4.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E747BF22-8A13-4073-967F-0C28055B2A45\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:cloud_orchestrator:2.4.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A9B95F0E-F10A-4A0A-B675-73AD50A552B2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:cloud_orchestrator:2.4.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"42AC5772-6E74-4B9C-815F-ED8C265FED53\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:cloud_orchestrator:2.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A66F93C9-05D1-4E81-A188-44BB0BDA3BC9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:cloud_orchestrator:2.5.01:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"88593BE3-6DB2-46B6-99B5-973D35C32BAD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:smartcloud_orchestrator:2.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2AB97A11-E8E6-4AFB-A72E-3345E36FE73C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:smartcloud_orchestrator:2.3.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9F658E9A-A6CA-4B00-B3B8-6261A8386B8B\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.\"}, {\"lang\": \"es\", \"value\": \"Se ha identificado una vulnerabilidad en la API services/[action]/launch en IBM Cloud Orchestrator. Un usuario de administrador de dominio autenticado podr\\u00eda modificar recursos de dominio cruzado a trav\\u00e9s de una llamada API /services/[action]/launch, siembre que hubiera sido posible para el usuario de administrador de dominio obtener acceso a un identificador de recurso del otro dominio.\"}]",
      "id": "CVE-2015-7494",
      "lastModified": "2024-11-21T02:36:52.463",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N\", \"baseScore\": 2.8, \"baseSeverity\": \"LOW\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.1, \"impactScore\": 1.4}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:S/C:N/I:P/A:N\", \"baseScore\": 1.7, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.1, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2017-02-08T22:59:00.247",
      "references": "[{\"url\": \"http://www.ibm.com/support/docview.wss?uid=swg2C1000140\", \"source\": \"psirt@us.ibm.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/94438\", \"source\": \"psirt@us.ibm.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.ibm.com/support/docview.wss?uid=swg2C1000140\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/94438\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}]",
      "sourceIdentifier": "psirt@us.ibm.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-284\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2015-7494\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2017-02-08T22:59:00.247\",\"lastModified\":\"2026-05-13T00:24:29.033\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una vulnerabilidad en la API services/[action]/launch en IBM Cloud Orchestrator. Un usuario de administrador de dominio autenticado podr\u00eda modificar recursos de dominio cruzado a trav\u00e9s de una llamada API /services/[action]/launch, siembre que hubiera sido posible para el usuario de administrador de dominio obtener acceso a un identificador de recurso del otro dominio.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N\",\"baseScore\":2.8,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.1,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:S/C:N/I:P/A:N\",\"baseScore\":1.7,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.1,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cloud_orchestrator:2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE37CE11-6A58-4058-B3A0-5A223DC5601B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cloud_orchestrator:2.4.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E747BF22-8A13-4073-967F-0C28055B2A45\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cloud_orchestrator:2.4.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A9B95F0E-F10A-4A0A-B675-73AD50A552B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cloud_orchestrator:2.4.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"42AC5772-6E74-4B9C-815F-ED8C265FED53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cloud_orchestrator:2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A66F93C9-05D1-4E81-A188-44BB0BDA3BC9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cloud_orchestrator:2.5.01:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"88593BE3-6DB2-46B6-99B5-973D35C32BAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:smartcloud_orchestrator:2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2AB97A11-E8E6-4AFB-A72E-3345E36FE73C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:smartcloud_orchestrator:2.3.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F658E9A-A6CA-4B00-B3B8-6261A8386B8B\"}]}]}],\"references\":[{\"url\":\"http://www.ibm.com/support/docview.wss?uid=swg2C1000140\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/94438\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.ibm.com/support/docview.wss?uid=swg2C1000140\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/94438\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]}]}}"
  }
}

CNVD-2016-11639

Vulnerability from cnvd - Published: 2016-11-30

Title

多款IBM产品安全绕过漏洞

Description

IBM Cloud Orchestrator是美国IBM公司的一套为IT服务提供云管理、加快软件与基础架构交付的解决方案。IBM SmartCloud Orchestrator是IBM云产品家族中的一个新产品。多款IBM产品存在安全绕过漏洞。攻击者可以利用漏洞绕过某些安全限制并执行未经授权的操作。

Severity

低

Patch Name

多款IBM产品安全绕过漏洞的补丁

Patch Description

IBM Cloud Orchestrator是美国IBM公司的一套为IT服务提供云管理、加快软件与基础架构交付的解决方案。IBM SmartCloud Orchestrator是IBM云产品家族中的一个新产品。多款IBM产品存在安全绕过漏洞。攻击者可以利用漏洞绕过某些安全限制并执行未经授权的操作。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： http://www-01.ibm.com/support/docview.wss?uid=swg2C1000140

Reference

http://www.securityfocus.com/bid/94438 http://www-01.ibm.com/support/docview.wss?uid=swg2C1000140

Impacted products

Name
['IBM Cloud Orchestrator 2.5', 'IBM Cloud Orchestrator 2.5.01', 'IBM Cloud Orchestrator 2.4', 'IBM Cloud Orchestrator 2.4.0.1', 'IBM Cloud Orchestrator 2.4.0.2', 'IBM Cloud Orchestrator 2.4.0.3', 'IBM SmartCloud Orchestrator 2.3', 'IBM SmartCloud Orchestrator 2.3.0.1']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "94438"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-7494"
    }
  },
  "description": "IBM Cloud Orchestrator\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u4e3aIT\u670d\u52a1\u63d0\u4f9b\u4e91\u7ba1\u7406\u3001\u52a0\u5feb\u8f6f\u4ef6\u4e0e\u57fa\u7840\u67b6\u6784\u4ea4\u4ed8\u7684\u89e3\u51b3\u65b9\u6848\u3002IBM SmartCloud Orchestrator\u662fIBM\u4e91\u4ea7\u54c1\u5bb6\u65cf\u4e2d\u7684\u4e00\u4e2a\u65b0\u4ea7\u54c1\u3002\r\n\r\n\u591a\u6b3eIBM\u4ea7\u54c1\u5b58\u5728\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6f0f\u6d1e\u7ed5\u8fc7\u67d0\u4e9b\u5b89\u5168\u9650\u5236\u5e76\u6267\u884c\u672a\u7ecf\u6388\u6743\u7684\u64cd\u4f5c\u3002",
  "discovererName": "IBM",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttp://www-01.ibm.com/support/docview.wss?uid=swg2C1000140",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-11639",
  "openTime": "2016-11-30",
  "patchDescription": "IBM Cloud Orchestrator\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u4e3aIT\u670d\u52a1\u63d0\u4f9b\u4e91\u7ba1\u7406\u3001\u52a0\u5feb\u8f6f\u4ef6\u4e0e\u57fa\u7840\u67b6\u6784\u4ea4\u4ed8\u7684\u89e3\u51b3\u65b9\u6848\u3002IBM SmartCloud Orchestrator\u662fIBM\u4e91\u4ea7\u54c1\u5bb6\u65cf\u4e2d\u7684\u4e00\u4e2a\u65b0\u4ea7\u54c1\u3002\r\n\r\n\u591a\u6b3eIBM\u4ea7\u54c1\u5b58\u5728\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6f0f\u6d1e\u7ed5\u8fc7\u67d0\u4e9b\u5b89\u5168\u9650\u5236\u5e76\u6267\u884c\u672a\u7ecf\u6388\u6743\u7684\u64cd\u4f5c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eIBM\u4ea7\u54c1\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM Cloud Orchestrator 2.5",
      "IBM Cloud Orchestrator  2.5.01",
      "IBM Cloud Orchestrator  2.4",
      "IBM Cloud Orchestrator  2.4.0.1",
      "IBM Cloud Orchestrator  2.4.0.2",
      "IBM Cloud Orchestrator  2.4.0.3",
      "IBM SmartCloud Orchestrator 2.3",
      "IBM SmartCloud Orchestrator  2.3.0.1"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/94438\r\nhttp://www-01.ibm.com/support/docview.wss?uid=swg2C1000140",
  "serverity": "\u4f4e",
  "submitTime": "2016-11-24",
  "title": "\u591a\u6b3eIBM\u4ea7\u54c1\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e"
}

FKIE_CVE-2015-7494

Vulnerability from fkie_nvd - Published: 2017-02-08 22:59 - Updated: 2026-05-13 00:24

Severity ?

2.8 (Low) - CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Summary

References

URL	Tags
psirt@us.ibm.com	http://www.ibm.com/support/docview.wss?uid=swg2C1000140	Patch, Vendor Advisory
psirt@us.ibm.com	http://www.securityfocus.com/bid/94438	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	http://www.ibm.com/support/docview.wss?uid=swg2C1000140	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/94438	Third Party Advisory, VDB Entry

Impacted products

Vendor	Product	Version
ibm	cloud_orchestrator	2.4
ibm	cloud_orchestrator	2.4.0.1
ibm	cloud_orchestrator	2.4.0.2
ibm	cloud_orchestrator	2.4.0.3
ibm	cloud_orchestrator	2.5
ibm	cloud_orchestrator	2.5.01
ibm	smartcloud_orchestrator	2.3
ibm	smartcloud_orchestrator	2.3.0.1

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:cloud_orchestrator:2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE37CE11-6A58-4058-B3A0-5A223DC5601B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_orchestrator:2.4.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E747BF22-8A13-4073-967F-0C28055B2A45",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_orchestrator:2.4.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9B95F0E-F10A-4A0A-B675-73AD50A552B2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_orchestrator:2.4.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "42AC5772-6E74-4B9C-815F-ED8C265FED53",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_orchestrator:2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "A66F93C9-05D1-4E81-A188-44BB0BDA3BC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_orchestrator:2.5.01:*:*:*:*:*:*:*",
              "matchCriteriaId": "88593BE3-6DB2-46B6-99B5-973D35C32BAD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:smartcloud_orchestrator:2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "2AB97A11-E8E6-4AFB-A72E-3345E36FE73C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:smartcloud_orchestrator:2.3.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "9F658E9A-A6CA-4B00-B3B8-6261A8386B8B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en la API services/[action]/launch en IBM Cloud Orchestrator. Un usuario de administrador de dominio autenticado podr\u00eda modificar recursos de dominio cruzado a trav\u00e9s de una llamada API /services/[action]/launch, siembre que hubiera sido posible para el usuario de administrador de dominio obtener acceso a un identificador de recurso del otro dominio."
    }
  ],
  "id": "CVE-2015-7494",
  "lastModified": "2026-05-13T00:24:29.033",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 1.7,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 2.8,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 1.1,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-02-08T22:59:00.247",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.ibm.com/support/docview.wss?uid=swg2C1000140"
    },
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/94438"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.ibm.com/support/docview.wss?uid=swg2C1000140"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/94438"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-P8HG-FCWF-R2VV

Vulnerability from github – Published: 2022-05-17 02:59 – Updated: 2022-05-17 02:59

Details

Severity ?

2.8 (Low)


                  
                    CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2015-7494"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-02-08T22:59:00Z",
    "severity": "LOW"
  },
  "details": "A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.",
  "id": "GHSA-p8hg-fcwf-r2vv",
  "modified": "2022-05-17T02:59:58Z",
  "published": "2022-05-17T02:59:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7494"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg2C1000140"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/94438"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2015-7494

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2015-7494

Aliases

CVE-2015-7494

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2015-7494",
    "description": "A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.",
    "id": "GSD-2015-7494"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2015-7494"
      ],
      "details": "A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.",
      "id": "GSD-2015-7494",
      "modified": "2023-12-13T01:20:01.274273Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "psirt@us.ibm.com",
        "ID": "CVE-2015-7494",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Cloud Orchestrator",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "2.2"
                        },
                        {
                          "version_value": "2.2.0.1"
                        },
                        {
                          "version_value": "2.3"
                        },
                        {
                          "version_value": "2.4"
                        },
                        {
                          "version_value": "2.3.0.1"
                        },
                        {
                          "version_value": "2.4.0.1"
                        },
                        {
                          "version_value": "2.4.0.2"
                        },
                        {
                          "version_value": "2.5"
                        },
                        {
                          "version_value": "2.5.0.1"
                        },
                        {
                          "version_value": "2.4.0.3"
                        },
                        {
                          "version_value": "2.5.0.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "IBM Corporation"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Gain Access"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://www.ibm.com/support/docview.wss?uid=swg2C1000140",
            "refsource": "CONFIRM",
            "url": "http://www.ibm.com/support/docview.wss?uid=swg2C1000140"
          },
          {
            "name": "94438",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/94438"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:ibm:cloud_orchestrator:2.4.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:cloud_orchestrator:2.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:cloud_orchestrator:2.5.01:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:cloud_orchestrator:2.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:cloud_orchestrator:2.4.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:smartcloud_orchestrator:2.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:smartcloud_orchestrator:2.3.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:cloud_orchestrator:2.4.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2015-7494"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-284"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.ibm.com/support/docview.wss?uid=swg2C1000140",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.ibm.com/support/docview.wss?uid=swg2C1000140"
            },
            {
              "name": "94438",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/94438"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 1.7,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 3.1,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.0"
          },
          "exploitabilityScore": 1.1,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2017-02-14T18:45Z",
      "publishedDate": "2017-02-08T22:59Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2015-7494 (GCVE-0-2015-7494)

CNVD-2016-11639

FKIE_CVE-2015-7494

GHSA-P8HG-FCWF-R2VV

GSD-2015-7494

Tags

Sightings

Nomenclature