CVE-2015-1882: ibm websphere_application_server Race Condition

Vulnerability summary

CVE-2015-1882 is a high (CVSS 8.5) Race Condition vulnerability in ibm websphere_application_server. EPSS estimates a 3.02% chance of exploitation in the next 30 days, higher than 87.3% of scored vulnerabilities.

Timeline

1. 26-04-2015
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.