PT-2017-13131 · Ibm · Ibm Websphere Application Server

Published 2017-07-24 · Updated 2019-10-03 · CVE-2017-1382

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 9.0

Description The issue allows a local attacker to potentially gain access to files with unknown impact due to the application server creating files using default permissions instead of customized permissions when custom startup scripts are used.

Recommendations For IBM WebSphere Application Server versions 7.0 through 9.0, consider modifying the custom startup scripts to ensure files are created with the intended customized permissions until a fix is available.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2017-1382

Affected Products

Ibm Websphere Application Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-1382 · Security Note
• http://ibm.com/support/docview.wss?uid=swg22004785 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1382 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/127153 · Vendor Advisory
• http://securitytracker.com/id/1038977 · Note
• http://securityfocus.com/bid/99960 · Note