CVE-2015-0196: IBM WebSphere Commerce

Medium severity, CVSS 5.0. EPSS: 1.3% chance of exploitation in the next 30 days.

CRLF injection vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11 and 7.0 before 7.0.0.8 Cumulative iFix 2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.

Affected products

• IBM WebSphere Commerce: version 6.0.0.1 only; version 6.0.0.2 only; version 6.0.0.3 only; version 6.0.0.4 only; version 6.0.0.5 only; version 6.0.0.6 only; …

Published 2015-06-29. Last modified 2026-06-17.