PT-2017-10269 · Ibm · Websphere Cast Iron Solution

Published 2017-05-05 · Updated 2017-05-12 · CVE-2016-9692

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM WebSphere Cast Iron Solution versions 7.0.0 through 7.5.0.0

Description The issue is caused by improper validation of user-supplied input, allowing a remote attacker to exploit it and induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with.

Recommendations For IBM WebSphere Cast Iron Solution versions 7.0.0 through 7.5.0.0, update to a version that properly validates user-supplied input to prevent External Service Interaction attacks.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-9692

Affected Products

Websphere Cast Iron Solution

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-9692 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9692 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=swg21998014 · Vendor Advisory
• http://securityfocus.com/bid/98337 · Note