PT-2017-10269 · Ibm · Websphere Cast Iron Solution

Publicado 2017-05-05 · Atualizado 2017-05-12 · CVE-2016-9692

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM WebSphere Cast Iron Solution versions 7.0.0 through 7.5.0.0

Description The issue is caused by improper validation of user-supplied input, allowing a remote attacker to exploit it and induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with.

Recommendations For IBM WebSphere Cast Iron Solution versions 7.0.0 through 7.5.0.0, update to a version that properly validates user-supplied input to prevent External Service Interaction attacks.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-9692

Produtos afetados

Websphere Cast Iron Solution

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-9692 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-9692 · Aviso do Fabricante
• http://ibm.com/support/docview.wss?uid=swg21998014 · Aviso do Fabricante
• http://securityfocus.com/bid/98337 · Nota