← Back

CVE-2015-8965

nvd nist
Published: Apr 6, 2017Modified: May 13, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administration code. The issue exists because the ilog.views.faces.IlvFacesController servlet in jviews-framework-all.jar does not require explicit configuration of servlets that can be called.

Affected (4)

Perforce
1 product
Jviews
Oracle
1 product
Data Integrator
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Perforce
Jviews
Up to 8.8
Jviews
Version 8.9
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Oracle
Data Integrator
Version 12.2.1.3.0
Data Integrator
Version 12.2.1.4.0

Related CWEs

CWE-264
CWE-264

References (6)

Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Patch

Timeline

No history available yet.