CVE-2015-1961

Severity: critical (CVSS 9.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-07-13 · updated 2026-06-17
Weakness: CWE-284

Description

The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions and execute arbitrary JavaScript code on the server via an unspecified API call.

Affected products

IBM Business Process Manager: 7.5.0.0, 7.5.0.1, 7.5.1.0, 7.5.1.1, 8.0.0.0, 8.0.1.0 (+7)

References

http://www-01.ibm.com/support/docview.wss?uid=swg1JR53356
http://www-01.ibm.com/support/docview.wss?uid=swg21959052
http://www.securityfocus.com/bid/75536
http://www.securitytracker.com/id/1032972
http://www-01.ibm.com/support/docview.wss?uid=swg1JR53356
http://www-01.ibm.com/support/docview.wss?uid=swg21959052
http://www.securityfocus.com/bid/75536
http://www.securitytracker.com/id/1032972

Get alerted when CVE-2015-1961 or the next vulnerability affects your stack