CVEvulnerability

CVE-2015-7494

2.8 LOW Published 2017-02-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-02-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
2.8 LOW — CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
CVSS 2.0 ([email protected])
1.7 LOW — AV:L/AC:L/Au:S/C:N/I:P/A:N
Weaknesses
CWE-284

Description

A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.

Affected configurations

• ibm cloud orchestrator 2.4 • ibm cloud orchestrator 2.4.0.1 • ibm cloud orchestrator 2.4.0.2 • ibm cloud orchestrator 2.4.0.3 • ibm cloud orchestrator 2.5 • ibm cloud orchestrator 2.5.01 • ibm smartcloud orchestrator 2.3 • ibm smartcloud orchestrator 2.3.0.1

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References