Unscored severity · published Aug 23, 2015
CVE-2015-2018
IBM Integration Bus 9 and 10 before 10.0.0.1 and WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.7 do not ensure that the correct security profile is selected, which…
–
CVSS
0.9%
EPSS
No
On KEV
Description
IBM Integration Bus 9 and 10 before 10.0.0.1 and WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.7 do not ensure that the correct security profile is selected, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IB
Integration Bus · Ibm
9.0; 10.0 · source: NVD
WM
Websphere Message Broker · Ibm
7.0.; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +9 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2018
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2018
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1IT07773
Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21961734
More from Integration Bus
9.1
CVE-2016-9706
IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when…
8.1
CVE-2017-1694
IBM Integration Bus 9.0 and 10.0 transmits user credentials in plain in clear text which can be read by an attacker using man in the middle techniques
6.7
CVE-2025-36014
IBM Integration Bus for z/OS code injection
6.5
CVE-2024-27265
IBM Integration Bus for z/OS cross-site request forgery
6.5
CVE-2024-22332
IBM Integration Bus for z/OS denial of service