CVE-2015-7494: IBM Cloud Orchestrator

Low severity, CVSS 2.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.

Affected products

• IBM Cloud Orchestrator: version 2.4 only; version 2.4.0.1 only; version 2.4.0.2 only; version 2.4.0.3 only; version 2.5 only; version 2.5.01 only
• IBM Smartcloud Orchestrator: version 2.3 only; version 2.3.0.1 only

Published 2017-02-08. Last modified 2026-06-17.