PT-2016-2310 · Ibm · Ibm Websphere Application Server

Published 2016-07-08 · Updated 2016-11-28 · CVE-2016-2945

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebSphere Application Server versions 8.5.5.8 through 8.5.5.9

Description The issue is related to the implementation of the API Discovery server in WebSphere Application Server, which is associated with insufficient access control. This can be exploited by a remote attacker to gain elevated privileges using an external reference in a Swagger document.

Recommendations For versions 8.5.5.8 through 8.5.5.9, update to Liberty Fix Pack 16.0.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Swagger document to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2016-01699

CVE-2016-2945

Affected Products

Ibm Websphere Application Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-2945 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1PI62450 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01699 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21984502 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-2945 · Vendor Advisory
• http://securityfocus.com/bid/91517 · Note