What is the CVSS score of CVE-2015-5011?

CVE-2015-5011 has a CVSS 2.0 base score of 3.2 (Low). CVSS vector: AV:L/AC:L/Au:S/C:N/I:P/A:P. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2015-5011?

Yes, a patch is available for CVE-2015-5011. Update the affected software to the latest version immediately.

Integration Bus CVE-2015-5011

LOW

Command Injection (CWE-77)

2015-10-26 psirt@us.ibm.com

Command Injection IBM Integration Bus Websphere Message Broker

3.2

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

3.2 LOW

AV:L/AC:L/Au:S/C:N/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Confidentiality

None

Integrity

Availability

Lifecycle Timeline

CVE Published

Oct 26, 2015 - 02:59 cve.org

LOW 3.2

DescriptionCVE.org

IBM WebSphere Message Broker 8 before 8.0.0.6 and Integration Bus 9 before 9.0.0.4 do not check authorization for MQSISTARTMSGFLOW and MQSISTOPMSGFLOW commands, which allows local users to bypass intended access restrictions, and start or stop a service, by issuing a command.

AnalysisAI

IBM WebSphere Message Broker 8 before 8.0.0.6 and Integration Bus 9 before 9.0.0.4 do not check authorization for MQSISTARTMSGFLOW and MQSISTOPMSGFLOW commands, which allows local users to bypass. Rated low severity (CVSS 3.2), this vulnerability is low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.

Technical ContextAI

This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. IBM WebSphere Message Broker 8 before 8.0.0.6 and Integration Bus 9 before 9.0.0.4 do not check authorization for MQSISTARTMSGFLOW and MQSISTOPMSGFLOW commands, which allows local users to bypass intended access restrictions, and start or stop a service, by issuing a command. Affected products include: Ibm Websphere Message Broker, Ibm Integration Bus. Version information: before 8.0.0.6.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.