PT-2023-13701 · Ibm · Ibm Websphere Application Server Liberty+2

Publicado 2023-05-03 · Atualizado 2025-03-03 · CVE-2022-39161

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 9.0 IBM WebSphere Application Server Liberty

Description The issue allows an authenticated user to conduct spoofing attacks when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server. A man-in-the-middle attacker could exploit this using a certificate issued by a trusted authority to obtain sensitive information.

Recommendations For IBM WebSphere Application Server versions 7.0 through 9.0, update to a version that includes the fix for this issue. For IBM WebSphere Application Server Liberty, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Web Server Plug-ins for IBM WebSphere Application Server to minimize the risk of exploitation.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2022-39161

Produtos afetados

Ibm Websphere Application Server

Ibm Websphere Application Server Liberty

Web Server Plug-Ins For Ibm Websphere Application Server

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-39161 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-39161 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/235069 · Aviso do Fabricante
• https://t.me/cvenotify/49750 · Publicação no Telegram
• https://t.me/cvenotify/50111 · Publicação no Telegram
• https://t.me/cibsecurity/63250 · Publicação no Telegram
• https://twitter.com/knaepp/status/1896591408917631474 · Publicação no Twitter
• https://ibm.com/support/pages/node/6987779 · Aviso do Fabricante