CVE-2015-1882 : Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty P

Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user.

Published 2015-04-27 12:59:03

Updated 2016-08-04 03:18:06

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2015-1882

IBM » Websphere Application Server » Version: 8.5.0.0
cpe:2.3:a:ibm:websphere_application_server:8.5.0.0:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Application Server » Version: 8.5.0.1
cpe:2.3:a:ibm:websphere_application_server:8.5.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Application Server » Version: 8.5.0.2
cpe:2.3:a:ibm:websphere_application_server:8.5.0.2:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Application Server » Version: 8.5.5.0
cpe:2.3:a:ibm:websphere_application_server:8.5.5.0:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Application Server » Version: 8.5.5.1
cpe:2.3:a:ibm:websphere_application_server:8.5.5.1:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Application Server » Version: 8.5.5.2
cpe:2.3:a:ibm:websphere_application_server:8.5.5.2:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Application Server » Version: 8.5.5.3
cpe:2.3:a:ibm:websphere_application_server:8.5.5.3:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Application Server » Version: 8.5.5.4
cpe:2.3:a:ibm:websphere_application_server:8.5.5.4:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2015-1882

Top countries where our scanners detected CVE-2015-1882

Top open port discovered on systems with this issue 80

IPs affected by CVE-2015-1882 90

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2015-1882!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2015-1882

EPSS FAQ

0.69%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 79 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-1882

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
8.5	HIGH	AV:N/AC:M/Au:S/C:C/I:C/A:C	6.8	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2015-1882

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-1882

http://www-01.ibm.com/support/docview.wss?uid=swg1PI33357

IBM notice: The page you requested cannot be displayed
http://www.securitytracker.com/id/1032190

IBM WebSphere Application Server Bugs Let Remote and Remote Authenticated Users Gain Elevated Privileges - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
http://www-01.ibm.com/support/docview.wss?uid=swg21697368

IBM Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.5.5
Patch;Vendor Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/74222

IBM WebSphere Application Server CVE-2015-1882 Remote Privilege Escalation Vulnerability
Third Party Advisory;VDB Entry