PT-2017-1546 · Ibm · Ibm Websphere Application Server

Published 2017-03-20 · Updated 2019-10-03 · CVE-2017-1151

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebSphere Application Server versions 8.0 through 9.0

Description The issue is related to insufficient access control in the OpenID Connect (OIDC) and Trust Association Interceptor (TAI) components of the WebSphere Application Server. This could allow a remote attacker to gain elevated privileges on the system.

Recommendations For versions 8.0 through 9.0, update the configuration to properly restrict access control for OpenID Connect and Trust Association Interceptor components to prevent privilege escalation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2017-00691

CVE-2017-1151

Affected Products

Ibm Websphere Application Server

References · 6

• https://bdu.fstec.ru/vul/2017-00691 · Security Note
• http://ibm.com/support/docview.wss?uid=swg21999293 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1151 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1151 · Vendor Advisory
• http://securitytracker.com/id/1037984 · Note
• http://securityfocus.com/bid/96841 · Note