CVE-2015-5022

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-10-06 · updated 2026-06-17
Weakness: CWE-200

Description

IBM Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 and 1.0.0.3 before 1.0.0.3_2, when access by guests is enabled, place an internal hostname and a payload path in a response, which allows remote authenticated users to obtain sensitive information by leveraging a trading-partner relationship and reading response fields.

Affected products

IBM B2B Advanced Communications: 1.0.0.1, 1.0.0.2, 1.0.0.3

References

http://www-01.ibm.com/support/docview.wss?uid=swg1IT10702
http://www-01.ibm.com/support/docview.wss?uid=swg21967334
http://www-01.ibm.com/support/docview.wss?uid=swg1IT10702
http://www-01.ibm.com/support/docview.wss?uid=swg21967334

Get alerted when CVE-2015-5022 or the next vulnerability affects your stack