CVE-2015-7494

LowCVSS 2.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.

Metrics

CVSS 3.0 2.8/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
IBM Corporation	Cloud Orchestrator	2.2; 2.2.0.1; 2.3; 2.4; 2.3.0.1; 2.4.0.1; 2.4.0.2; 2.5; 2.5.0.1; 2.4.0.3; 2.5.0.2

References

http://www.ibm.com/support/docview.wss?uid=swg2C1000140Patch, Vendor Advisory
http://www.securityfocus.com/bid/94438Third Party Advisory, VDB Entry
http://www.ibm.com/support/docview.wss?uid=swg2C1000140Patch, Vendor Advisory
http://www.securityfocus.com/bid/94438Third Party Advisory, VDB Entry

Timeline

Published: Feb 8, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-74967.2GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.CVE-2015-74975.0Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to ca CVE-2015-74985.0Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a CVE-2015-74995.0Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitiv CVE-2015-75005.0The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds CVE-2015-75019.8Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Appli CVE-2015-75025.1Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the CVE-2015-75037.5Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA CVE-2015-75048.8Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of servi CVE-2015-75058.8Stack-based buffer overflow in the gif_next_LZW function in libnsgif.c in Libnsgif 0.1.2 allows context-dependent attackers to cause a denia CVE-2015-75066.5The gif_next_LZW function in libnsgif.c in Libnsgif 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds rea CVE-2015-75077.5libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a crafted color table