IBM · WebSphere Application Server and Server Hypervisor Edition
CVE-2015-7450
IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
What it is
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
CISA: Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: July 10, 2022
- Added to the CISA list
- January 10, 2022
- Published
- January 2, 2016
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 98% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-94
- More details
- NVD · CVE.org · CISA
All references (9)
- http://www-01.ibm.com/support/docview.wss?uid=swg21971733
- http://www-01.ibm.com/support/docview.wss?uid=swg21971342
- http://www-01.ibm.com/support/docview.wss?uid=swg21971758
- http://www.securityfocus.com/bid/77653
- http://www.securitytracker.com/id/1035125
- http://www-01.ibm.com/support/docview.wss?uid=swg21972799
- http://www-01.ibm.com/support/docview.wss?uid=swg21971376
- https://www.exploit-db.com/exploits/41613/
- http://www-01.ibm.com/support/docview.wss?uid=swg21970575
More exploited flaws from IBM
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 4, 2026 | Code Injection | Langflow | Critical 9.8 | 29% |
| Feb 21, 2023 | Code Execution | Aspera Faspex | Critical 9.8 | >99.9% |
| May 25, 2022 | Invalid Input | InfoSphere BigInsights | Medium 6.5 | 4.8% |
| Nov 3, 2021 | Remote Code Execution | Planning Analytics | Critical 10.0 | 86% |
| Nov 3, 2021 | Security Bypass | Data Risk Manager | Critical 9.0 | 70% |
| Nov 3, 2021 | Remote Code Execution | Data Risk Manager | Critical 9.1 | 62% |
| Nov 3, 2021 | Directory Traversal | Data Risk Manager | Medium 4.3 | 69% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.