CVE-2015-7494 IBM CVE debrief

Who should care

Administrators and security teams running IBM Cloud Orchestrator or IBM SmartCloud Orchestrator, especially environments that rely on domain separation and delegate admin privileges. IAM, platform, and operations teams should also care because the flaw involves cross-domain authorization boundaries.

Technical summary

NVD describes the flaw as an authorization control failure (CWE-284) affecting IBM Cloud Orchestrator and SmartCloud Orchestrator versions listed in the CPEs. The vulnerable interface is the services/[action]/launch API. An authenticated domain admin may be able to modify cross-domain resources when they can access another domain’s resource identifier. NVD’s CVSS v3.0 vector is AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N, indicating limited integrity impact, no confidentiality or availability impact, and a requirement for authenticated access and favorable conditions.

Defensive priority

Low, but still actionable in multi-tenant or domain-separated deployments because the flaw can cross authorization boundaries and alter another domain’s resources.

Recommended defensive actions

• Apply the IBM patch or vendor guidance referenced in the IBM PSIRT advisory for this issue.
• Confirm whether any IBM Cloud Orchestrator 2.4, 2.4.0.1, 2.4.0.2, 2.4.0.3, 2.5, 2.5.01, or SmartCloud Orchestrator 2.3 / 2.3.0.1 systems are in use.
• Review domain-admin permissions and verify that resource identifiers cannot be used to reach objects outside the intended domain boundary.
• Audit logs for unexpected cross-domain modification attempts through the services/[action]/launch API.
• Validate any custom integrations or automation that call the launch API to ensure they enforce domain scoping correctly.

Evidence notes

The description, CVSS vector, CWE-284 classification, affected CPEs, and references are all drawn from the supplied NVD-derived source item. IBM PSIRT is referenced as the source for the vendor advisory/patch link, and SecurityFocus is listed as a third-party advisory/VDB entry. The CVE was published on 2017-02-08 and later modified on 2026-05-13; the publication date is the relevant disclosure timing for this debrief.

Official resources