CVE-2015-1884

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-06-28 · updated 2026-06-17
Weakness: CWE-22

Description

Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted internationalization-file URL.

Affected products

IBM Business Process Manager: 7.5.0.0, 7.5.0.1, 7.5.1.0, 7.5.1.1, 7.5.1.2, 8.0.0.0 (+7)
IBM Websphere: 7.2, 7.2.0.1, 7.2.0.2, 7.2.0.3, 7.2.0.4, 7.2.0.5

References

http://www-01.ibm.com/support/docview.wss?uid=swg1JR52957
http://www-01.ibm.com/support/docview.wss?uid=swg21700831
http://www.securityfocus.com/bid/75360
http://www.securitytracker.com/id/1032700
http://www.securitytracker.com/id/1032701
http://www-01.ibm.com/support/docview.wss?uid=swg1JR52957
http://www-01.ibm.com/support/docview.wss?uid=swg21700831
http://www.securityfocus.com/bid/75360
http://www.securitytracker.com/id/1032700
http://www.securitytracker.com/id/1032701

Get alerted when CVE-2015-1884 or the next vulnerability affects your stack