CVE-2015-7472 : IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0

IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF20, and 8.5.0 before CF10 allows remote attackers to conduct LDAP injection attacks, and consequently read or write to repository data, via unspecified vectors.

Published 2016-02-15 02:59:12

Updated 2025-04-12 10:46:41

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2015-7472

IBM » Websphere Portal » Version: 6.1.0.0
cpe:2.3:a:ibm:websphere_portal:6.1.0.0:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Portal » Version: 7.0.0.0
cpe:2.3:a:ibm:websphere_portal:7.0.0.0:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Portal » Version: 6.1.5.0
cpe:2.3:a:ibm:websphere_portal:6.1.5.0:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Portal » Version: 8.0.0.0
cpe:2.3:a:ibm:websphere_portal:8.0.0.0:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Portal » Version: 6.1.0.1
cpe:2.3:a:ibm:websphere_portal:6.1.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Portal » Version: 6.1.0.2
cpe:2.3:a:ibm:websphere_portal:6.1.0.2:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Portal » Version: 6.1.0.3
cpe:2.3:a:ibm:websphere_portal:6.1.0.3:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Portal » Version: 7.0.0.1
cpe:2.3:a:ibm:websphere_portal:7.0.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Portal » Version: 7.0.0.2
cpe:2.3:a:ibm:websphere_portal:7.0.0.2:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Portal » Version: 8.0.0.1
cpe:2.3:a:ibm:websphere_portal:8.0.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Portal » Version: 6.1.5.1
cpe:2.3:a:ibm:websphere_portal:6.1.5.1:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Portal » Version: 6.1.0.4
cpe:2.3:a:ibm:websphere_portal:6.1.0.4:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Portal » Version: 6.1.5.2
cpe:2.3:a:ibm:websphere_portal:6.1.5.2:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Portal » Version: 6.1.5.3
cpe:2.3:a:ibm:websphere_portal:6.1.5.3:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Portal » Version: 6.1.0.5
cpe:2.3:a:ibm:websphere_portal:6.1.0.5:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Portal » Version: 6.1.0.6
cpe:2.3:a:ibm:websphere_portal:6.1.0.6:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Portal » Version: 8.5.0.0
cpe:2.3:a:ibm:websphere_portal:8.5.0.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-7472

EPSS FAQ

0.33%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 53 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-7472

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.4	MEDIUM	AV:N/AC:L/Au:N/C:P/I:P/A:N	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
7.2	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	3.9	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: Low Integrity: Low Availability: None

References for CVE-2015-7472

http://www-01.ibm.com/support/docview.wss?uid=swg1PI53426

IBM notice: The page you requested cannot be displayed
http://www-01.ibm.com/support/docview.wss?uid=swg21972736

IBM Security Bulletin: Fix Available for LDAP Injection Vulnerability in IBM WebSphere Portal (CVE-2015-7472)
Vendor Advisory
http://www.securitytracker.com/id/1035324

IBM WebSphere Portal Input Validation Flaw Lets Remote Users Inject LDAP Commands - SecurityTracker

Jump to

Vulnerability Details : CVE-2015-7472

Products affected by CVE-2015-7472

Exploit prediction scoring system (EPSS) score for CVE-2015-7472

CVSS scores for CVE-2015-7472

References for CVE-2015-7472