Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-7419: IBM WebSphere Portal can be crashed by crafted requests

CVE-2015-7419 · published 10 years ago

Summary

A remote user can send specially formed web requests to IBM WebSphere Portal versions 8.0.0.1 (before fix CF19) and 8.5.0 (before fix CF09) that cause the server to consume excessive memory and stop responding. This results in a denial of service, preventing legitimate users from accessing the portal. Apply the latest IBM-provided updates or patches for the affected versions to stop the behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	websphere_portal	8.0.0.1 8.5.0.0 `cpe:2.3:a:ibm:websphere_portal:8.0.0.1:::::::*`

Original advisory text

IBM WebSphere Portal 8.0.0.1 before CF19 and 8.5.0 before CF09 allows remote attackers to cause a denial of service (memory consumption) via crafted requests.

References

http://www-01.ibm.com/support/docview.wss?uid=swg1PI50952 Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21969906 Vendor Advisory
http://www.securitytracker.com/id/1034146 Third Party Advisory VDB Entry

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.8 High

Exploitation

3% chance of attack within 30 days

Type

CWE-399Resource Management Errors

Timeline

Published14 Nov 2015

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2015-7419 · NVD

Track software like this

Free during beta