製品・ソフトウェアに関する情報

JVN脆弱性詳細

IBM WebSphere Application Server における任意のコードを実行される脆弱性

Title	IBM WebSphere Application Server における任意のコードを実行される脆弱性
Summary	IBM WebSphere Application Server (WAS) には、任意のコードを実行される脆弱性が存在します。補足情報 : CWE による脆弱性タイプは、CWE-284: Improper Access Control (不適切なアクセス制御) と識別されています。 http://cwe.mitre.org/data/definitions/284.html
Possible impacts	第三者により、management-port セッションに巧妙に細工された命令を送信されることで、任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 28, 2015, midnight
Registration Date	May 21, 2015, 4:47 p.m.
Last Update	May 21, 2015, 4:47 p.m.

CVSS2.0 : 危険
Score	10
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected System

IBM

IBM WebSphere Application Server 6.1 から 6.1.0.47

IBM WebSphere Application Server 7.0.0.39 未満の 7.0

IBM WebSphere Application Server 8.0.0.11 未満の 8.0

IBM WebSphere Application Server 8.5.5.6 未満の 8.5

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-1920	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1920
National Vulnerability Database (NVD)
2	CVE-2015-1920	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1920

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-Other	https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther

ベンダー情報

No	Name	URL
IBM Support Document
1	1883573	http://www-01.ibm.com/support/docview.wss?uid=swg21883573

Change Log

No	Changed Details	Date of change
0	[2015年05月21日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2015-1920

Summary	IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.5.5.6 allows remote attackers to execute arbitrary code by sending crafted instructions in a management-port session.
Publication Date	May 20, 2015, 9:59 a.m.
Registration Date	Jan. 26, 2021, 2:46 p.m.
Last Update	Nov. 21, 2024, 11:26 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:ibm:websphere_application_server:6.1.0.21:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.31:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.14:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.0.2:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.12:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.2:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.37:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.31:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.19:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.24:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.47:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.25:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.33:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.18:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.5:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.15:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.2:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.5.1:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.23:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.38:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.7:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.5.0:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.33:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.11:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.25:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.32:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.1:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.5.5:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.11:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.41:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.39:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.14:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.4:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.34:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.19:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.17:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.43:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.9:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.0:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.1:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.27:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.29:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.8:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.7:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.2:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.22:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.5.4:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.3:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.17:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.13:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.29:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.0.1:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.0.0:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.15:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.0:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.13:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.3:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.21:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.9:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.23:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.10:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.5.3:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.3:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.35:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.1:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.5.2:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.16:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.12:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.27:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.36:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.5:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.6:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.10:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.37:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.45:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/74439	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/74439	Third Party Advisory VDB Entry
3	http://www.securitytracker.com/id/1032249	Third Party Advisory VDB Entry
4	http://www.securitytracker.com/id/1032249	Third Party Advisory VDB Entry
5	http://www-01.ibm.com/support/docview.wss?uid=swg1PI38302	Not Applicable
6	http://www-01.ibm.com/support/docview.wss?uid=swg1PI38302	Not Applicable
7	http://www-01.ibm.com/support/docview.wss?uid=swg21883573	Patch Vendor Advisory
8	http://www-01.ibm.com/support/docview.wss?uid=swg21883573	Patch Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-284	不適切なアクセス制御	https://cwe.mitre.org/data/definitions/284.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:ibm:websphere_application_server:6.1.0.21:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.31:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.14:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.0.2:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.12:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.2:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.37:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.31:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.19:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.24:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.47:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.25:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.33:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.18:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.5:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.15:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.2:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.5.1:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.23:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.38:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.7:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.5.0:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.33:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.11:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.25:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.32:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.1:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.5.5:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.11:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.41:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.39:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.14:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.4:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.34:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.19:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.17:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.43:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.9:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.0:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.1:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.27:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.29:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.8:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.7:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.2:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.22:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.5.4:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.3:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.17:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.13:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.29:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.0.1:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.0.0:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.15:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.0:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.13:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.3:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.21:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.9:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.23:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.10:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.5.3:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.3:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.35:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.1:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.5.5.2:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.16:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.12:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.27:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.36:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.5:::::::*
cpe:2.3:a:ibm:websphere_application_server:8.0.0.6:::::::*
cpe:2.3:a:ibm:websphere_application_server:7.0.0.10:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.37:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0.45:::::::*
cpe:2.3:a:ibm:websphere_application_server:6.1.0:::::::*