Improper Neutralization of Special Elements in Output Used by a Downstream Component in Jazz Reporting Service - CVE-2015-7466
Published: January 10, 2016 / Updated: August 9, 2020
Vulnerability identifier: #VU40529
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-7466
CWE-ID: CWE-74
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to manipulate data.
Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended query restrictions or modify the LDAP directory, via unspecified vectors.
Affected software
Jazz Reporting Service
How to mitigate CVE-2015-7466
Install update from vendor's website.