CVE-2015-8965

Critical

Published: 06/04/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Rogue Wave JViews before version 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath. The issue exists because the ilog.views.faces.IlvFacesController servlet does not require explicit configuration of servlets that can be called.

Risk Assessment

Attackers can exploit this vulnerability to execute malicious code, potentially leading to system compromise or data leakage.

Recommendation

It is recommended to update to the latest version of Rogue Wave JViews and to configure servlets to restrict access to only trusted components.

Original NVD description (English source)

Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administration code. The issue exists because the ilog.views.faces.IlvFacesController servlet in jviews-framework-all.jar does not require explicit configuration of servlets that can be called.