// For flags

CVE-2015-1914

JDK: unspecified partial Java sandbox restrictions bypass

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

IBM Java 7 R1 before SR3, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to bypass "permission checks" and obtain sensitive information via vectors related to the Java Virtual Machine.

IBM Java 7 R1 anterior a SR3, 7 anterior a SR9, 6 R1 anterior a SR8 FP4, 6 anterior a SR16 FP4, y 5.0 anterior a SR16 FP10 permite a atacantes remotos evadir 'comprobaciones de permisos' y obtener información sensible a través de vectores relacionados con Java Virtual Machine.

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat Product Security.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2015-02-19 CVE Reserved
  • 2015-05-13 CVE Published
  • 2024-08-06 CVE Updated
  • 2025-06-13 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Ibm
Search vendor "Ibm"
 Java
Search vendor "Ibm" for product "Java"
 >= 5.0.0.0 < 5.0.16.10
Search vendor "Ibm" for product "Java" and version " >= 5.0.0.0 < 5.0.16.10"
-
Affected
Ibm
Search vendor "Ibm"
 Java
Search vendor "Ibm" for product "Java"
 >= 6.0.0.0 < 6.0.16.4
Search vendor "Ibm" for product "Java" and version " >= 6.0.0.0 < 6.0.16.4"
-
Affected
Ibm
Search vendor "Ibm"
 Java
Search vendor "Ibm" for product "Java"
 >= 6.1.0.0 < 6.1.8.4
Search vendor "Ibm" for product "Java" and version " >= 6.1.0.0 < 6.1.8.4"
-
Affected
Ibm
Search vendor "Ibm"
 Java
Search vendor "Ibm" for product "Java"
 >= 7.0.0.0 < 7.0.9.0
Search vendor "Ibm" for product "Java" and version " >= 7.0.0.0 < 7.0.9.0"
-
Affected
Ibm
Search vendor "Ibm"
 Java
Search vendor "Ibm" for product "Java"
 >= 7.1.0.0 < 7.1.3.0
Search vendor "Ibm" for product "Java" and version " >= 7.1.0.0 < 7.1.3.0"
-
Affected