VIR Vulnerability Intelligence Relay

CVE-2015-1927

medium
Published 2015-07-14 · Modified 2026-05-06
CVSS v3
—
CVSS v2
6.8
VIR risk
6.8

Description

The default configuration of IBM WebSphere Application Server (WAS) 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has a false value for the com.ibm.ws.webcontainer.disallowServeServletsByClassname WebContainer property, which allows remote attackers to obtain privileged access via unspecified vectors.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: psirt@us.ibm.com — http://www-01.ibm.com/support/docview.wss?uid=swg21959083

Application impact
VendorProductVersionsFixed
ibm ibmwebsphere_application_server7.0
ibm ibmwebsphere_application_server7.0.0.1
ibm ibmwebsphere_application_server7.0.0.2
ibm ibmwebsphere_application_server7.0.0.3
ibm ibmwebsphere_application_server7.0.0.4
ibm ibmwebsphere_application_server7.0.0.5
ibm ibmwebsphere_application_server7.0.0.6
ibm ibmwebsphere_application_server7.0.0.7
ibm ibmwebsphere_application_server7.0.0.8
ibm ibmwebsphere_application_server7.0.0.9
ibm ibmwebsphere_application_server7.0.0.10
ibm ibmwebsphere_application_server7.0.0.11
ibm ibmwebsphere_application_server7.0.0.12
ibm ibmwebsphere_application_server7.0.0.13
ibm ibmwebsphere_application_server7.0.0.14
ibm ibmwebsphere_application_server7.0.0.15
ibm ibmwebsphere_application_server7.0.0.16
ibm ibmwebsphere_application_server7.0.0.17
ibm ibmwebsphere_application_server7.0.0.18
ibm ibmwebsphere_application_server7.0.0.19
ibm ibmwebsphere_application_server7.0.0.21
ibm ibmwebsphere_application_server7.0.0.22
ibm ibmwebsphere_application_server7.0.0.23
ibm ibmwebsphere_application_server7.0.0.24
ibm ibmwebsphere_application_server7.0.0.25
ibm ibmwebsphere_application_server7.0.0.27
ibm ibmwebsphere_application_server7.0.0.29
ibm ibmwebsphere_application_server7.0.0.31
ibm ibmwebsphere_application_server7.0.0.32
ibm ibmwebsphere_application_server7.0.0.33
ibm ibmwebsphere_application_server7.0.0.34
ibm ibmwebsphere_application_server7.0.0.36
ibm ibmwebsphere_application_server7.0.0.37
ibm ibmwebsphere_application_server7.0.0.38
ibm ibmwebsphere_application_server8.0.0.0
ibm ibmwebsphere_application_server8.0.0.1
ibm ibmwebsphere_application_server8.0.0.2
ibm ibmwebsphere_application_server8.0.0.3
ibm ibmwebsphere_application_server8.0.0.4
ibm ibmwebsphere_application_server8.0.0.5
ibm ibmwebsphere_application_server8.0.0.6
ibm ibmwebsphere_application_server8.0.0.7
ibm ibmwebsphere_application_server8.0.0.8
ibm ibmwebsphere_application_server8.0.0.9
ibm ibmwebsphere_application_server8.0.0.10
ibm ibmwebsphere_application_server8.5.0.0
ibm ibmwebsphere_application_server8.5.0.1
ibm ibmwebsphere_application_server8.5.0.2
ibm ibmwebsphere_application_server8.5.5.0
ibm ibmwebsphere_application_server8.5.5.1
ibm ibmwebsphere_application_server8.5.5.2
ibm ibmwebsphere_application_server8.5.5.3
ibm ibmwebsphere_application_server8.5.5.4
ibm ibmwebsphere_application_server8.5.5.5

References

CWEs

CWE-284

Verify integrity in audit chain (admin only). AS-IS.