IBM Sterling B2B Integrator CVE-2015-7450
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
AnalysisAI
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenticated network attackers to execute arbitrary commands by sending malicious serialized Java objects exploiting the Apache Commons Collections InvokerTransformer class. This vulnerability is confirmed actively exploited in the wild per CISA KEV, with public exploit code available (Exploit-DB 41613) and an exceptionally high EPSS score of 93.49%, indicating near-certain exploitation probability. Affected products include Sterling B2B Integrator 5.2, Sterling Integrator 5.1, and Tivoli Common Reporting versions 2.1 through 3.1.2.1.
Technical ContextAI
This vulnerability exploits unsafe Java object deserialization (CWE-502) in applications using vulnerable versions of Apache Commons Collections 3.x. The InvokerTransformer class allows attackers to construct serialized objects that, when deserialized by the application, invoke arbitrary methods through reflection. IBM products expose serialized-object interfaces (likely JMX, RMI, or HTTP endpoints accepting serialized data) without proper input validation. The CPE data identifies specific affected versions: Sterling B2B Integrator 5.2.x, Sterling Integrator 5.1.x, and Tivoli Common Reporting 2.1.x through 3.1.2.1. The root cause is the inherently dangerous design of InvokerTransformer combined with application acceptance of untrusted serialized input, enabling gadget chain construction that achieves code execution.
RemediationAI
Apply vendor-released patches immediately per IBM Security Bulletins swg21970575, swg21971342, swg21971376, swg21971758, and swg21972799, which provide specific fix versions for each affected product line (exact patched versions are documented in the individual bulletins linked in references). If immediate patching is infeasible, implement network segmentation to restrict access to serialization endpoints to trusted IP ranges only, disable or remove JMX/RMI remote access if not operationally required (note: this may break monitoring/management tools), and deploy intrusion prevention signatures targeting known Commons Collections deserialization payloads (available from major IPS vendors post-2015). Given confirmed active exploitation, workarounds provide minimal protection-prioritize emergency patching within 24-48 hours for internet-exposed instances and within one week for internal systems.
More from same product – last 7 days
Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.1 lets unauthenticated network attackers run arbitr
Remote code execution and authentication bypass are possible in IBM Aspera High-Speed Transfer Server and High-Speed Tra
Authentication bypass in IBM Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) versions 1.5.1 throu
Hard-coded credentials in IBM Controller (versions 11.0.1, 11.1.0, 11.1.1, and 11.1.2) give attackers a static, embedded
Arbitrary code execution in IBM Aspera High-Speed Transfer Server and Endpoint (versions 3.7.4 through 4.4.7 Fix Pack 1)
Share
External POC / Exploit Code
Leaving vuln.today