CVE-2015-7450: ibm sterling b2b integrator +6 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2015-7450

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 97,8%

Kerentanan Deserialization of Untrusted Data pada ibm sterling b2b integrator, ibm sterling integrator +5 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 10 Januari 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.

Rincian

Terbit di NVD: 2 Januari 2016
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-502: Deserialization of Untrusted Data
EPSS (30 hari): 97,8% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
Masuk KEV: 10 Januari 2022
Tenggat CISA: 10 Juli 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
ibm	sterling b2b integrator	Versi 5.2
ibm	sterling integrator	Versi 5.1
ibm	tivoli common reporting	Versi 2.1
ibm	tivoli common reporting	Versi 2.1.1
ibm	tivoli common reporting	Versi 2.1.1.2
ibm	tivoli common reporting	Versi 3.1
ibm	tivoli common reporting	Versi 3.1.0.1
ibm	tivoli common reporting	Versi 3.1.0.2
ibm	tivoli common reporting	Versi 3.1.2
ibm	tivoli common reporting	Versi 3.1.2.1
ibm	watson content analytics	Versi 3.0 hingga 3.0.0.6
ibm	watson content analytics	Versi 3.5 hingga 3.5.0.3
ibm	watson explorer analytical components	Versi 10.0 hingga 10.0.0.2
ibm	watson explorer analytical components	Versi 11.0
ibm	watson explorer annotation administration console	Versi 10.0 hingga 10.0.0.2
ibm	watson explorer annotation administration console	Versi 11.0
ibm	websphere application server	Versi 7.0.0.0
ibm	websphere application server	Versi 8.0.0.0
ibm	websphere application server	Versi 8.5
ibm	websphere application server	Versi 8.5.0.0
ibm	websphere application server	Versi 8.5.5.5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://www-01.ibm.com/support/docview.wss?uid=swg21970575 advisory vendor
http://www-01.ibm.com/support/docview.wss?uid=swg21971342 advisory vendor
http://www-01.ibm.com/support/docview.wss?uid=swg21971376 advisory vendor
http://www-01.ibm.com/support/docview.wss?uid=swg21971758 advisory vendor
http://www-01.ibm.com/support/docview.wss?uid=swg21972799 advisory vendor
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-7450 pemerintah AS
http://www.securityfocus.com/bid/77653 broken link · advisory pihak ketiga · vdb entry
http://www.securitytracker.com/id/1035125 broken link · advisory pihak ketiga · vdb entry
https://www.exploit-db.com/exploits/41613/ exploit · advisory pihak ketiga · vdb entry
http://www-01.ibm.com/support/docview.wss?uid=swg21971733 broken link

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.