PT-2015-1649 · Ibm · Ibm Websphere Application Server

Published 2015-07-14 · Updated 2016-11-30 · CVE-2015-1936

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebSphere Application Server versions 8.0.0 through 8.0.0.10 WebSphere Application Server versions 8.5 through 8.5.5.5

Description The issue is related to inadequate access control in the administrative console of the WebSphere Application Server. It allows a remote attacker to gain access to a session by manipulating the JSESSIONID parameter when the Security feature is disabled.

Recommendations For WebSphere Application Server versions 8.0.0 through 8.0.0.10, update to version 8.0.0.11 or later. For WebSphere Application Server versions 8.5 through 8.5.5.5, update to version 8.5.5.6 or later. As a temporary workaround, consider enabling the Security feature to prevent session hijacking via the JSESSIONID parameter.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2015-10995

CVE-2015-1936

Affected Products

Ibm Websphere Application Server

References · 6

• http://www-01.ibm.com/support/docview.wss?uid=swg1PI37230 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10995 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21959083 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1936 · Security Note
• http://securityfocus.com/bid/75480 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1936 · Note