Vulnerability Details : CVE-2015-7466
Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended query restrictions or modify the LDAP directory, via unspecified vectors.
Exploit prediction scoring system (EPSS) score for CVE-2015-7466
Probability of exploitation activity in the next 30 days: 0.07%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 30 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2015-7466
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:P/A:N |
8.0
|
2.9
|
NIST |
|
3.1
|
LOW | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
1.6
|
1.4
|
NIST |
CWE ids for CVE-2015-7466
-
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-7466
-
http://www-01.ibm.com/support/docview.wss?uid=swg21972484
IBM notice: The page you requested cannot be displayedVendor Advisory
Products affected by CVE-2015-7466
- cpe:2.3:a:ibm:jazz_reporting_service:6.0:*:*:*:*:*:*:*