CVE-2015-7450
IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
Description
CVE-2015-7450 is a critical-severity deserialization of untrusted data vulnerability affecting IBM WebSphere Application Server and multiple other IBM products. Serialized-object interfaces in IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, exploiting the InvokerTransformer class in the Apache Commons Collections library. This deserialization vulnerability carries a CVSS score of 9.8 and enables unauthenticated remote code execution against IBM WebSphere and related products. CISA has added CVE-2015-7450 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 93.49% (99.82nd percentile), exploitation is near-certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ibm | sterling b2b integrator | 5.2 |
| ibm | sterling integrator | 5.1 |
| ibm | tivoli common reporting | 2.1; 2.1.1; 2.1.1.2; 3.1; 3.1.0.1; 3.1.0.2; 3.1.2; 3.1.2.1 |
| ibm | watson content analytics | >= 3.0, <= 3.0.0.6; >= 3.5, <= 3.5.0.3 |
| ibm | watson explorer analytical components | >= 10.0, <= 10.0.0.2; 11.0 |
| ibm | watson explorer annotation administration console | >= 10.0, <= 10.0.0.2; 11.0 |
| ibm | websphere application server | 7.0.0.0; 8.0.0.0; 8.5; 8.5.0.0; 8.5.5.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21970575(Vendor Advisory)
- http://www-01.ibm.com/support/docview.wss?uid=swg21971342(Vendor Advisory)
- http://www-01.ibm.com/support/docview.wss?uid=swg21971376(Vendor Advisory)
- http://www-01.ibm.com/support/docview.wss?uid=swg21971733(Broken Link)
- http://www-01.ibm.com/support/docview.wss?uid=swg21971758(Vendor Advisory)
- http://www-01.ibm.com/support/docview.wss?uid=swg21972799(Vendor Advisory)
- http://www.securityfocus.com/bid/77653(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1035125(Broken Link, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41613/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-7450(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
In the context of CVE-2015-7450, IBM WebSphere Application Server and other IBM products deserialize Java objects from untrusted sources without sufficient verification. Attackers craft malicious serialized Java objects using the Apache Commons Collections InvokerTransformer class as a "gadget chain" that triggers arbitrary command execution during the deserialization process. This deserialization of untrusted data weakness is among the most severe vulnerability classes, consistently enabling remote code execution with no authentication required.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2015-7450 has a CVSS 3.1 score of 9.8 (CRITICAL), representing a maximum-severity threat to organizations running affected IBM products. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction, representing the worst-case exploitability scenario. Confidentiality (High): attackers can access all data available to the application server, including database connections, configuration files, and credentials stored in the WebSphere environment. Integrity (High): arbitrary command execution allows attackers to modify application data, deploy malicious applications, and alter server configurations. Availability (High): attackers can disrupt application services, destroy data, or use the compromised server to pivot deeper into the enterprise network. The EPSS score of 93.49% (99.82nd percentile) indicates near-certain exploitation, and the broad range of affected IBM products amplifies the vulnerability's impact across enterprise environments.
Exploit Maturity
CVE-2015-7450 has a highly mature exploit landscape with publicly available exploit code. Public exploit code is available via Exploit-DB, providing a ready-to-use tool for exploiting the Java deserialization vulnerability in IBM WebSphere and related products. CISA has confirmed active exploitation in the wild through its KEV catalog listing with a remediation deadline of 2022-07-10. The EPSS score of 93.49% (99.82nd percentile) indicates near-certain exploitation activity. The underlying Apache Commons Collections deserialization issue affects many Java applications beyond IBM products, and the availability of generic exploitation frameworks (such as ysoserial) further lowers the barrier for attackers targeting this vulnerability class.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. IBM has released fixes for WebSphere Application Server and all affected products addressing the Apache Commons Collections deserialization vulnerability.
- Verify all IBM product installations across the organization, including WebSphere Application Server versions 7.0.0.0, 8.0.0.0, 8.5, 8.5.0.0, and 8.5.5.5, as well as Sterling B2B Integrator 5.2, Sterling Integrator 5.1, Tivoli Common Reporting, Watson Content Analytics, and Watson Explorer components, and ensure all are updated to patched versions.
- Remove or replace the vulnerable Apache Commons Collections library if patching the IBM product is not immediately possible. IBM provides instructions for replacing the InvokerTransformer class or upgrading the Commons Collections library to a version that disables dangerous transformers by default.
- Review application server logs for indicators of deserialization exploitation, including unusual serialized object submissions to management interfaces, unexpected process executions by the application server user, and signs of unauthorized access to application resources.
- Implement defense-in-depth by restricting access to WebSphere management interfaces and serialized-object endpoints to trusted networks only, deploying Java deserialization filters (available in JDK 9+ or via backport libraries), and monitoring for known Java exploitation tool signatures in network traffic.
Technical Details
CVE-2015-7450 is caused by CWE-502 (Deserialization of Untrusted Data) in serialized-object interfaces across multiple IBM products, with IBM WebSphere Application Server being the primary target. The vulnerability exploits the Apache Commons Collections library's InvokerTransformer class, which allows arbitrary method invocation during Java object deserialization. Attackers construct a "gadget chain" — a sequence of serialized objects that, when deserialized, trigger a chain of method calls ultimately executing arbitrary operating system commands. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects maximum exploitability: the attack is network-accessible, low complexity, requires no authentication, and needs no user interaction. The vulnerability is part of the broader Apache Commons Collections deserialization issue that affected many Java applications in 2015, but IBM's exposure was particularly severe due to the widespread deployment of WebSphere in enterprise environments and the multiple product lines sharing the vulnerable library.
Frequently Asked Questions
Is CVE-2015-7450 being actively exploited?
Yes. CVE-2015-7450 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Public exploit code is available on Exploit-DB, and the EPSS score of 93.49% (99.82nd percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2015-7450?
CVE-2015-7450 affects multiple IBM products, including WebSphere Application Server (versions 7.0.0.0, 8.0.0.0, 8.5, 8.5.0.0, 8.5.5.5), Sterling B2B Integrator 5.2, Sterling Integrator 5.1, Tivoli Common Reporting (multiple versions), Watson Content Analytics, and Watson Explorer components. All are affected through the shared Apache Commons Collections library.
How do I fix CVE-2015-7450?
Apply the vendor-provided patches for each affected IBM product. For WebSphere Application Server, IBM has released specific fix packs addressing the deserialization vulnerability. As an interim measure, replace or disable the vulnerable InvokerTransformer class in the Apache Commons Collections library.
How severe is CVE-2015-7450?
CVE-2015-7450 has a CVSS 3.1 score of 9.8 (CRITICAL). It enables unauthenticated remote code execution through Java deserialization, requires no user interaction, and is remotely exploitable with low complexity. Its EPSS score places it in the 99.82nd percentile for exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.