VulnerabilityModified
CVE-2014-4767
IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.3 does not properly use the Liberty Repository for feature installation, which allows remote authenticated users to execute arbitrary code via unspecified vectors.
MEDIUM 6.5EPSS 2.71%
Does this matter?
Lower severity and a low EPSS score (2.71%). Track it; it rarely justifies an emergency change on its own.
Description
IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.3 does not properly use the Liberty Repository for feature installation, which allows remote authenticated users to execute arbitrary code via unspecified vectors.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 2.71% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- ibm/websphere application server
- Source
- psirt@us.ibm.com
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1PI21284
- http://www-01.ibm.com/support/docview.wss?uid=swg21681249Vendor Advisory
- http://www.securityfocus.com/bid/69297
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94832
- http://www-01.ibm.com/support/docview.wss?uid=swg1PI21284
- http://www-01.ibm.com/support/docview.wss?uid=swg21681249Vendor Advisory
- http://www.securityfocus.com/bid/69297
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94832
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.