Unscored severity · published Nov 8, 2015
CVE-2015-4963
IBM Security Access Manager for Web 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandles WebSEAL HTTPTransformation requests, which allows remote attackers to read or write to…
–
CVSS
3.3%
EPSS
No
On KEV
Description
IBM Security Access Manager for Web 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandles WebSEAL HTTPTransformation requests, which allows remote attackers to read or write to arbitrary files via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Security Access Manager For Web · Ibm
7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +20 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-4963
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-4963
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1IV71196
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21964828
www.securitytracker.com
http://www.securitytracker.com/id/1034103
More from Security Access Manager For Web
9.1
CVE-2016-3028
IBM Security Access Manager for Web 7.0 before IF2 and 8.0 before 8.0.1.4 IF3 and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remote authenticated users to execute…
6.1
CVE-2017-1489
IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability
6.1
CVE-2016-3018
IBM Security Access Manager for Web is vulnerable to cross-site scripting
5.9
CVE-2017-1476
IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 could allow a remote attacker to obtain sensitive information, caused by the failure…
5.3
CVE-2017-1474
IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 discloses sensitive information to unauthorized users