CVE-2015-7454

Severity: medium (CVSS 4.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-03-21 · updated 2026-06-17
Weakness: CWE-264

Description

Business Space in IBM WebSphere Process Server 6.1.2.0 through 7.0.0.5 and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0.x through 8.5.0.2, 8.5.5.x through 8.5.5.0, and 8.5.6.x through 8.5.6.2 allows remote authenticated users to bypass intended access restrictions and create an arbitrary page or space via unspecified vectors.

Affected products

IBM Business Process Manager: 7.5.0.0, 7.5.0.1, 7.5.1.0, 7.5.1.1, 7.5.1.2, 8.0.0.0 (+11)
IBM Websphere Process Server: 6.1.2, 6.1.2.1, 6.1.2.2, 6.1.2.3, 6.2, 6.2.0.1 (+8)

References

http://www-01.ibm.com/support/docview.wss?uid=swg1JR54678
http://www-01.ibm.com/support/docview.wss?uid=swg21972005
http://www.securityfocus.com/bid/85089
http://www.securitytracker.com/id/1035319
http://www-01.ibm.com/support/docview.wss?uid=swg1JR54678
http://www-01.ibm.com/support/docview.wss?uid=swg21972005
http://www.securityfocus.com/bid/85089
http://www.securitytracker.com/id/1035319

Get alerted when CVE-2015-7454 or the next vulnerability affects your stack