PT-2016-2310 · Ibm · Ibm Websphere Application Server

Publicado 2016-07-08 · Atualizado 2016-11-28 · CVE-2016-2945

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebSphere Application Server versions 8.5.5.8 through 8.5.5.9

Description The issue is related to the implementation of the API Discovery server in WebSphere Application Server, which is associated with insufficient access control. This can be exploited by a remote attacker to gain elevated privileges using an external reference in a Swagger document.

Recommendations For versions 8.5.5.8 through 8.5.5.9, update to Liberty Fix Pack 16.0.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Swagger document to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2016-01699

CVE-2016-2945

Produtos afetados

Ibm Websphere Application Server

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-2945 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg1PI62450 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-01699 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg21984502 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-2945 · Aviso do Fabricante
• http://securityfocus.com/bid/91517 · Nota