Vulnerability CVE-2015-7494


Published: 2017-02-08   Modified: 2017-02-09

Description:
A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.

CVSS2 => (AV:L/AC:L/Au:S/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
1.7/10
2.9/10
3.1/10
Exploit range
Attack complexity
Authentication
Local
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
IBM -> Cloud orchestrator 
IBM -> Smartcloud orchestrator 

 References:
http://www.ibm.com/support/docview.wss?uid=swg2C1000140
http://www.securityfocus.com/bid/94438

Copyright 2024, cxsecurity.com

 

Back to Top