PT-2018-14050 · Ibm · Ibm Websphere Application Server Liberty

Publicado 2018-08-24 · Atualizado 2019-10-09 · CVE-2018-1755

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server Liberty (affected versions not specified)

Description The issue is caused by incorrect transport being used when Liberty is configured to use Java Authentication SPI for Containers (JASPIC), allowing a remote attacker to obtain sensitive information. This can occur when the Application Server is configured to permit access on non-secure (http) port and is using JASPIC or JSR375 authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-1755

Produtos afetados

Ibm Websphere Application Server Liberty

Referências · 5

• https://ibm.com/support/docview.wss?uid=ibm10728689 · Aviso do Fabricante
• http://securityfocus.com/bid/105150 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1755 · Nota de Segurança
• http://securitytracker.com/id/1041558 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/148597 · Aviso do Fabricante