« Volver al listado

CVE-2015-7494

Estado: ModificadaBaja (2.8)—

A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

IBM — Cloud OrchestratorIBM — Smartcloud Orchestrator

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-7494",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 1.7,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.1,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 2.8,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.1
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "vendor": "IBM Corporation",
          "product": "Cloud Orchestrator",
          "versions": [
            {
              "status": "affected",
              "version": "2.2"
            },
            {
              "status": "affected",
              "version": "2.2.0.1"
            },
            {
              "status": "affected",
              "version": "2.3"
            },
            {
              "status": "affected",
              "version": "2.4"
            },
            {
              "status": "affected",
              "version": "2.3.0.1"
            },
            {
              "status": "affected",
              "version": "2.4.0.1"
            },
            {
              "status": "affected",
              "version": "2.4.0.2"
            },
            {
              "status": "affected",
              "version": "2.5"
            },
            {
              "status": "affected",
              "version": "2.5.0.1"
            },
            {
              "status": "affected",
              "version": "2.4.0.3"
            },
            {
              "status": "affected",
              "version": "2.5.0.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-02-08T22:59:00.247",
  "references": [
    {
      "url": "http://www.ibm.com/support/docview.wss?uid=swg2C1000140",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/94438",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www.ibm.com/support/docview.wss?uid=swg2C1000140",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/94438",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en la API services/[action]/launch en IBM Cloud Orchestrator. Un usuario de administrador de dominio autenticado podría modificar recursos de dominio cruzado a través de una llamada API /services/[action]/launch, siembre que hubiera sido posible para el usuario de administrador de dominio obtener acceso a un identificador de recurso del otro dominio."
    }
  ],
  "lastModified": "2026-06-17T00:32:37.423",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:cloud_orchestrator:2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE37CE11-6A58-4058-B3A0-5A223DC5601B"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_orchestrator:2.4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E747BF22-8A13-4073-967F-0C28055B2A45"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_orchestrator:2.4.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9B95F0E-F10A-4A0A-B675-73AD50A552B2"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_orchestrator:2.4.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42AC5772-6E74-4B9C-815F-ED8C265FED53"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_orchestrator:2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A66F93C9-05D1-4E81-A188-44BB0BDA3BC9"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_orchestrator:2.5.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88593BE3-6DB2-46B6-99B5-973D35C32BAD"
            },
            {
              "criteria": "cpe:2.3:a:ibm:smartcloud_orchestrator:2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2AB97A11-E8E6-4AFB-A72E-3345E36FE73C"
            },
            {
              "criteria": "cpe:2.3:a:ibm:smartcloud_orchestrator:2.3.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F658E9A-A6CA-4B00-B3B8-6261A8386B8B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}